Bug 214237
| Summary: | Stack buffer lifetime mis-use in ncal(1) | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Jonathan de Boyne Pollard <J.deBoynePollard-newsgroups> |
| Component: | misc | Assignee: | Eric van Gyzen <vangyzen> |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | CC: | vangyzen |
| Priority: | --- | ||
| Version: | 10.3-STABLE | ||
| Hardware: | Any | ||
| OS: | Any | ||
A commit references this bug: Author: vangyzen Date: Sat Nov 5 14:08:15 UTC 2016 New revision: 308340 URL: https://svnweb.freebsd.org/changeset/base/308340 Log: ncal: fix a reference to an out-of-scope stack buffer PR: 214237 Submitted by: Jonathan de Boyne Pollard MFC after: 3 days Sponsored by: Dell EMC Changes: head/usr.bin/ncal/ncal.c A commit references this bug: Author: vangyzen Date: Wed Nov 30 20:51:14 UTC 2016 New revision: 309335 URL: https://svnweb.freebsd.org/changeset/base/309335 Log: MFC r308340 ncal: fix a reference to an out-of-scope stack buffer PR: 214237 Submitted by: Jonathan de Boyne Pollard Sponsored by: Dell EMC Changes: _U stable/11/ stable/11/usr.bin/ncal/ncal.c A commit references this bug: Author: vangyzen Date: Wed Nov 30 20:51:51 UTC 2016 New revision: 309336 URL: https://svnweb.freebsd.org/changeset/base/309336 Log: MFC r308340 ncal: fix a reference to an out-of-scope stack buffer PR: 214237 Submitted by: Jonathan de Boyne Pollard Sponsored by: Dell EMC Changes: _U stable/10/ stable/10/usr.bin/ncal/ncal.c |
The buffer used to obtain the standout start and standout end sequences from termcap is used long after its lifetime has ended, and potentially something else has written to that area of stack storage. The fix is to adjust line 1113 of usr.bin/ncal/ncal.c to static char cbuf[512]; char tbuf[1024], *b;