Bug 214237 - Stack buffer lifetime mis-use in ncal(1)
Summary: Stack buffer lifetime mis-use in ncal(1)
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: misc (show other bugs)
Version: 10.3-STABLE
Hardware: Any Any
: --- Affects Only Me
Assignee: Eric van Gyzen
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-11-05 08:42 UTC by Jonathan de Boyne Pollard
Modified: 2016-11-30 20:53 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan de Boyne Pollard 2016-11-05 08:42:50 UTC 
The buffer used to obtain the standout start and standout end sequences from termcap is used long after its lifetime has ended, and potentially something else has written to that area of stack storage.

The fix is to adjust line 1113 of usr.bin/ncal/ncal.c to

    static char cbuf[512];
    char tbuf[1024], *b;
Comment 1 commit-hook freebsd_committer freebsd_triage 2016-11-05 14:08:55 UTC 
A commit references this bug:

Author: vangyzen
Date: Sat Nov  5 14:08:15 UTC 2016
New revision: 308340
URL: https://svnweb.freebsd.org/changeset/base/308340

Log:
  ncal: fix a reference to an out-of-scope stack buffer

  PR:		214237
  Submitted by:	Jonathan de Boyne Pollard
  MFC after:	3 days
  Sponsored by:	Dell EMC

Changes:
  head/usr.bin/ncal/ncal.c
Comment 2 commit-hook freebsd_committer freebsd_triage 2016-11-30 20:51:54 UTC 
A commit references this bug:

Author: vangyzen
Date: Wed Nov 30 20:51:14 UTC 2016
New revision: 309335
URL: https://svnweb.freebsd.org/changeset/base/309335

Log:
  MFC r308340

  ncal: fix a reference to an out-of-scope stack buffer

  PR:		214237
  Submitted by:	Jonathan de Boyne Pollard
  Sponsored by:	Dell EMC

Changes:
_U  stable/11/
  stable/11/usr.bin/ncal/ncal.c
Comment 3 commit-hook freebsd_committer freebsd_triage 2016-11-30 20:52:57 UTC 
A commit references this bug:

Author: vangyzen
Date: Wed Nov 30 20:51:51 UTC 2016
New revision: 309336
URL: https://svnweb.freebsd.org/changeset/base/309336

Log:
  MFC r308340

  ncal: fix a reference to an out-of-scope stack buffer

  PR:		214237
  Submitted by:	Jonathan de Boyne Pollard
  Sponsored by:	Dell EMC

Changes:
_U  stable/10/
  stable/10/usr.bin/ncal/ncal.c