From 1a4531bc98da1de16bed68ecba051d6bf3a4764f Mon Sep 17 00:00:00 2001 From: John Baldwin Date: Wed, 2 Sep 2020 20:04:26 +0000 Subject: [PATCH] Compute the correct size of the string to move forward. Previously this was counting the amount of spare room at the start of the buffer that the string needed to move forward and passing that as the number of bytes to copy to memmove rather than the length of the string to be copied. In the strfmon test in the test suite this caused the memmove to overflow the allocated buffer by one byte which CHERI caught. Reported by: CHERI Reviewed by: kevans Obtained from: CheriBSD MFC after: 1 week Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D26280 --- lib/libc/stdlib/strfmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libc/stdlib/strfmon.c b/lib/libc/stdlib/strfmon.c index fd4e15d1080..d646ec0b001 100644 --- a/lib/libc/stdlib/strfmon.c +++ b/lib/libc/stdlib/strfmon.c @@ -645,7 +645,7 @@ __format_grouped_double(double value, int *flags, memset(bufend, pad_char, padded); } - bufsize = bufsize - (bufend - rslt) + 1; + bufsize = rslt + bufsize - bufend; memmove(rslt, bufend, bufsize); free(avalue); return (rslt);