DragonFlyBSD Kernel Audit
DF-0041 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/link_elf_obj.c b/sys/kern/link_elf_obj.c
--- a/sys/kern/link_elf_obj.c
+++ b/sys/kern/link_elf_obj.c
@@ -588,7 +588,7 @@
 		panic("lost symbol string index");
 	/* Allocate space for and load the symbol strings */
 	ef->ddbstrcnt = shdr[symstrindex].sh_size;
-	ef->ddbstrtab = kmalloc(shdr[symstrindex].sh_size, M_LINKER, M_WAITOK);
+	ef->ddbstrtab = kmalloc(shdr[symstrindex].sh_size + 1, M_LINKER, M_WAITOK);
 	error = vn_rdwr(UIO_READ, vp, ef->ddbstrtab,
 			shdr[symstrindex].sh_size, shdr[symstrindex].sh_offset,
 			UIO_SYSSPACE, IO_NODELOCKED, p->p_ucred, &resid);
@@ -609,6 +609,7 @@
 		error = vn_rdwr(UIO_READ, vp, ef->shstrtab,
 				shdr[shstrindex].sh_size, shdr[shstrindex].sh_offset,
 				UIO_SYSSPACE, IO_NODELOCKED, p->p_ucred, &resid);
+		ef->shstrtab[shdr[shstrindex].sh_size] = 0;
 		if (error)
 			goto out;
 		if (resid != 0) {