[src/trunk]: src/lib/librumpuser Avoid buffer overflow

[kamil <kamil%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9983ef2f6b31
branches:  trunk
changeset: 1008483:9983ef2f6b31
user:      kamil <kamil%NetBSD.org@localhost>
date:      Tue Mar 24 01:56:56 2020 +0000

description:
Avoid buffer overflow

Detected with ASan + RUMPKERNEL.

diffstat:

 lib/librumpuser/rumpuser_sp.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (36 lines):

diff -r 2d9267455c8e -r 9983ef2f6b31 lib/librumpuser/rumpuser_sp.c
--- a/lib/librumpuser/rumpuser_sp.c     Tue Mar 24 01:13:41 2020 +0000
+++ b/lib/librumpuser/rumpuser_sp.c     Tue Mar 24 01:56:56 2020 +0000
@@ -1,4 +1,4 @@
-/*      $NetBSD: rumpuser_sp.c,v 1.72 2016/09/06 07:45:41 martin Exp $ */
+/*      $NetBSD: rumpuser_sp.c,v 1.73 2020/03/24 01:56:56 kamil Exp $  */
 
 /*
  * Copyright (c) 2010, 2011 Antti Kantee.  All Rights Reserved.
@@ -37,7 +37,7 @@
 #include "rumpuser_port.h"
 
 #if !defined(lint)
-__RCSID("$NetBSD: rumpuser_sp.c,v 1.72 2016/09/06 07:45:41 martin Exp $");
+__RCSID("$NetBSD: rumpuser_sp.c,v 1.73 2020/03/24 01:56:56 kamil Exp $");
 #endif /* !lint */
 
 #include <sys/types.h>
@@ -717,7 +717,7 @@
 
        /* ensure comm is 0-terminated */
        /* TODO: make sure it contains sensible chars? */
-       comm[commlen] = '\0';
+       comm[commlen - 1] = '\0';
 
        lwproc_switch(spc->spc_mainlwp);
        lwproc_execnotify(comm);
@@ -981,7 +981,7 @@
 
                        /* ensure it's 0-terminated */
                        /* XXX make sure it contains sensible chars? */
-                       comm[commlen] = '\0';
+                       comm[commlen - 1] = '\0';
 
                        /* make sure we fork off of proc1 */
                        _DIAGASSERT(lwproc_curlwp() == NULL);