diff options
| author | David Xu <davidxu@FreeBSD.org> | 2005-09-26 14:14:55 +0000 |
|---|---|---|
| committer | David Xu <davidxu@FreeBSD.org> | 2005-09-26 14:14:55 +0000 |
| commit | 2b7182c6b7fc8c77f606926b42f471dfb9fa381b (patch) | |
| tree | 42fdff0be28e0601ed5294e7fb010f9ba9d49064 /sys/kern/kern_environment.c | |
| parent | db20dc4dbb9dd785871166dc1cfc1948aa355880 (diff) | |
| download | src-2b7182c6b7fc8c77f606926b42f471dfb9fa381b.tar.gz src-2b7182c6b7fc8c77f606926b42f471dfb9fa381b.zip | |
Reorder statements to avoid accessing unknown memory.
In theory, invoking kenv with very long string can panic
kernel.
Notes
Notes:
svn path=/head/; revision=150568
Diffstat (limited to 'sys/kern/kern_environment.c')
| -rw-r--r-- | sys/kern/kern_environment.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 4fd84ae5310d..9bb88140e9a9 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -240,8 +240,8 @@ _getenv_dynamic(const char *name, int *idx) sx_assert(&kenv_lock, SX_LOCKED); len = strlen(name); for (cp = kenvp[0], i = 0; cp != NULL; cp = kenvp[++i]) { - if ((cp[len] == '=') && - (strncmp(cp, name, len) == 0)) { + if ((strncmp(cp, name, len) == 0) && + (cp[len] == '=')) { if (idx != NULL) *idx = i; return (cp + len + 1); |