diff --git a/sys/kern/subr_module.c b/sys/kern/subr_module.c --- a/sys/kern/subr_module.c +++ b/sys/kern/subr_module.c @@ -66,7 +66,16 @@ * ought to strip the path names */ if (hdr[0] == MODINFO_NAME) { + size_t namelen = hdr[1]; scanname = curp + sizeof(u_int32_t) * 2; + /* Ensure the name field is NUL-terminated within its declared + * length before trusting strlen/strcmp on it. */ + if (hdr[1] == 0 || scanname[namelen - 1] != 0) { + next = sizeof(u_int32_t) * 2 + hdr[1]; + next = roundup(next, sizeof(u_long)); + curp += next; + continue; + } i = strlen(scanname); while (i > 0 && scanname[i-1] != '/') --i;