Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix stack use after scope in libutil/pty

Browse Source 
The pt variable's elements are used after the end of the pt scope.
A move of pt to outer scope fixes this.

Detected with MKSANITIZER/ASan with tmux(1), a forkpty(3) user.
This commit is contained in:
kamil 2018-06-24 09:30:26 +00:00
parent 9fa6cbad23
commit 171790efcf
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/libutil/pty.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: pty.c,v 1.31 2009/02/20 16:44:06 christos Exp $ */
/* $NetBSD: pty.c,v 1.32 2018/06/24 09:30:26 kamil Exp $ */
/*-
* Copyright (c) 1990, 1993, 1994
@ -34,7 +34,7 @@
#if 0
static char sccsid[] = "@(#)pty.c 8.3 (Berkeley) 5/16/94";
#else
__RCSID("$NetBSD: pty.c,v 1.31 2009/02/20 16:44:06 christos Exp $");
__RCSID("$NetBSD: pty.c,v 1.32 2018/06/24 09:30:26 kamil Exp $");
#endif
#endif /* LIBC_SCCS and not lint */
@ -70,6 +70,7 @@ openpty(int *amaster, int *aslave, char *name, struct termios *term,
mode_t mode;
struct group grs, *grp;
char grbuf[1024];
struct ptmget pt;
_DIAGASSERT(amaster != NULL);
_DIAGASSERT(aslave != NULL);
@ -78,7 +79,6 @@ openpty(int *amaster, int *aslave, char *name, struct termios *term,
/* winp may be NULL */
if ((master = open("/dev/ptm", O_RDWR)) != -1) {
struct ptmget pt;
if (ioctl(master, TIOCPTMGET, &pt) != -1) {
(void)close(master);
master = pt.cfd;