Vulnerable systems:
FreeBSD 3.2 (and earlier)
FreeBSD-current before the correction date.
FreeBSD 3.2-stable before the correction date.
Non-vulnerable systems:
FreeBSD-3.3 RELEASE
FreeBSD-current as of September 7, 1999
FreeBSD-3.2-stable as of August 25, 1999
The FreeBSD-3.3-RC series of releases are not affected.
FreeBSD recommends that you upgrade your system to one that is listed above as having the problem resolved, or you may patch your present systems.
To patch your present system apply the following patches to amd, rebuild, install and restart amd (or reboot).
Patches for 3.2-stable and -current systems before the resolution date:
/*
* Take a log format string and expand occurrences of %m
- * with the current error code taken from errno.
+ * with the current error code taken from errno. Make sure
+ * 'e' never gets longer than maxlen characters.
*/
static void
-expand_error(char *f, char *e)
+expand_error(char *f, char *e, int maxlen)
{
extern int sys_nerr;
- char *p;
+ char *p, *q;
int error = errno;
+ int len = 0;
+ /*
+ * XXX: ptr is 1024 bytes long. It is possible to write into it
+ * more than 1024 bytes, if efmt is already large, and vargs expand
+ * as well.
+ */
vsprintf(ptr, efmt, vargs);
+ msg[1023] = '\0'; /* null terminate, to be sure */
