HardenedBSD/lib
Bruce Evans b01f0b7d76 Obtained from: 1.1.5
getcwd() has two off-by-one bugs in FreeBSD-2.0:

1. getcwd(buf, size) fails when the size is just large enough.
2. getcwd(buf + 1, 1) incorrectly succeeds when the current directory
   is "/".  buf[0] and buf[2] are clobbered.

(I modified Bruce's original patch to return the proper error code
[ERANGE] in the case of #2, but otherwise... -DG)

This program demonstrates the bug:

---
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>

int main(void)
{
    char buf[5];
    int errors;

    errors = 0;
    if (chdir("/tmp") != 0) {
        perror("chdir");
        abort();
    }
    if (getcwd(buf, 5) == NULL) {
        perror("oops, getcwd failed for buffer size = size required");
        ++errors;
    }
    if (chdir("/") != 0) {
        perror("chdir");
        abort();
    }
    buf[0] = 0;
    buf[2] = 1;
    if (getcwd(buf + 1, 1) != NULL) {
        fprintf(stderr,
                "oops, getcwd succeeded for buffer size = one too small\n");
        ++errors;
    }
    if (buf[0] != 0) {
        fprintf(stderr,
                "oops, getcwd scribbled on memory before start of buffer\n");
        ++errors;
    }
    if (buf[2] != 1) {
        fprintf(stderr,
                "oops, getcwd scribbled on memory after end of buffer\n");
        ++errors;
    }
    exit(errors == 0 ? 0 : 1);
}
1994-12-12 01:29:13 +00:00
..
csu/i386
libc Obtained from: 1.1.5 1994-12-12 01:29:13 +00:00
libcompat
libcrypt
libcurses tputs: (char) -> (int) 1994-12-10 23:02:33 +00:00
libedit
libf2c
libF77
libforms
libI77
libkvm
libm
libmd
libmytinfo
libncurses tputs prototypes... 1994-12-10 23:10:41 +00:00
libpam/modules
libresolv
librpc
librpcsvc
libskey
libtelnet
libterm
libtermcap
libutil
liby
msun
ncurses/ncurses
rpcsvc
Makefile
Makefile.inc