diff options
| author | Aurelien Jarno <aurelien@aurel32.net> | 2014-05-16 00:03:37 +0200 |
|---|---|---|
| committer | Aurelien Jarno <aurelien@aurel32.net> | 2014-05-16 00:07:29 +0200 |
| commit | d0583c403952630c534b0605ff7d69af5ec473cc (patch) | |
| tree | 87b8ce3f6ac98870ceff9ec85e2b4fd1f3ec7641 /sysdeps/unix/sysv/linux/ptsname.c | |
| parent | c0c08d02c82275353f5c556f935a1a01714d9d7f (diff) | |
| download | glibc-d0583c403952630c534b0605ff7d69af5ec473cc.zip glibc-d0583c403952630c534b0605ff7d69af5ec473cc.tar.gz glibc-d0583c403952630c534b0605ff7d69af5ec473cc.tar.bz2 | |
ptsname_r: don't leak uninitialized memory (BZ #16917)
If the fd refers to a terminal device, but not a pty master, the
TIOCGPTN ioctl returns with ENOTTY. This error is not caught, and the
possibly undefined buffer passed to ptsname_r is sent directly to the
stat64 syscall.
Fix this by using a fallback to the old method only if the TIOCGPTN
ioctl fails with EINVAL. This also fix the return value in that specific
case (it return ENOENT without this patch).
Also add tests to the ptsname_r function (and ptsname at the same time).
Note: this is Debian bug#741482, reported by Jakub Wilk <jwilk@debian.org>
Diffstat (limited to 'sysdeps/unix/sysv/linux/ptsname.c')
| -rw-r--r-- | sysdeps/unix/sysv/linux/ptsname.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sysdeps/unix/sysv/linux/ptsname.c b/sysdeps/unix/sysv/linux/ptsname.c index ed39f8f..3fc14a7 100644 --- a/sysdeps/unix/sysv/linux/ptsname.c +++ b/sysdeps/unix/sysv/linux/ptsname.c @@ -105,7 +105,9 @@ __ptsname_internal (int fd, char *buf, size_t buflen, struct stat64 *stp) memcpy (__stpcpy (buf, devpts), p, &numbuf[sizeof (numbuf)] - p); } - else if (errno == EINVAL) + else if (errno != EINVAL) + return errno; + else #endif { char *p; |