From 1adbd77cab6f60b105c5d8b1a4350161c3ac213d Mon Sep 17 00:00:00 2001 From: Michael Haubenwallner Date: Mon, 9 Oct 2017 18:58:24 +0200 Subject: [PATCH] cygwin: fix potential buffer overflow in fork When fork fails, we can use "%s" now with system_sprintf for the errmsg rather than a (potentially too small) buffer for the format string. * fork.cc (fork): Use "%s" with system_printf now. --- winsup/cygwin/fork.cc | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/winsup/cygwin/fork.cc b/winsup/cygwin/fork.cc index 73a72f530..bcbef12d8 100644 --- a/winsup/cygwin/fork.cc +++ b/winsup/cygwin/fork.cc @@ -618,13 +618,8 @@ fork () if (!grouped.errmsg) syscall_printf ("fork failed - child pid %d, errno %d", grouped.child_pid, grouped.this_errno); else - { - char buf[strlen (grouped.errmsg) + sizeof ("child %d - , errno 4294967295 ")]; - strcpy (buf, "child %d - "); - strcat (buf, grouped.errmsg); - strcat (buf, ", errno %d"); - system_printf (buf, grouped.child_pid, grouped.this_errno); - } + system_printf ("child %d - %s, errno %d", grouped.child_pid, + grouped.errmsg, grouped.this_errno); set_errno (grouped.this_errno); }