From fd94099ec208321d81b8e997b185156b9af828d4 Mon Sep 17 00:00:00 2001
From: Colin Percival <cperciva@FreeBSD.org>
Date: Fri, 6 May 2005 02:50:00 +0000
Subject: If we are going to 1. Copy a NULL-terminated string into a
 fixed-length buffer, and 2. copyout that buffer to userland, we really ought
 to 0. Zero the entire buffer first.

Security: FreeBSD-SA-05:08.kmem
---
 sys/netinet/udp_usrreq.c | 1 +
 1 file changed, 1 insertion(+)

(limited to 'sys/netinet/udp_usrreq.c')

diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 42ee9285bfbc..ef8c62d77039 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -611,6 +611,7 @@ udp_pcblist(SYSCTL_HANDLER_ARGS)
 		inp = inp_list[i];
 		if (inp->inp_gencnt <= gencnt) {
 			struct xinpcb xi;
+			bzero(&xi, sizeof(xi));
 			xi.xi_len = sizeof xi;
 			/* XXX should avoid extra copy */
 			bcopy(inp, &xi.xi_inp, sizeof *inp);
-- 
cgit v1.3