From ab5cd6069740e67f35684c916767a362a8cc43e0 Mon Sep 17 00:00:00 2001 From: millert Date: Thu, 17 Jun 1999 16:28:58 +0000 Subject: When finding the end of dst, never traverse more than siz bytes. This keeps us from misbehaving if the user gives us a src string that is not NUL-terminated. This is one of those "should not happen" cases but it is good to play it safe. Pointed out by Casper Dik --- lib/libc/string/strlcat.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'lib/libc/string') diff --git a/lib/libc/string/strlcat.c b/lib/libc/string/strlcat.c index 2e8c56926ec..599994edf5a 100644 --- a/lib/libc/string/strlcat.c +++ b/lib/libc/string/strlcat.c @@ -1,4 +1,4 @@ -/* $OpenBSD: strlcat.c,v 1.1 1998/07/01 01:29:45 millert Exp $ */ +/* $OpenBSD: strlcat.c,v 1.2 1999/06/17 16:28:58 millert Exp $ */ /* * Copyright (c) 1998 Todd C. Miller @@ -28,7 +28,7 @@ */ #if defined(LIBC_SCCS) && !defined(lint) -static char *rcsid = "$OpenBSD: strlcat.c,v 1.1 1998/07/01 01:29:45 millert Exp $"; +static char *rcsid = "$OpenBSD: strlcat.c,v 1.2 1999/06/17 16:28:58 millert Exp $"; #endif /* LIBC_SCCS and not lint */ #include @@ -50,11 +50,11 @@ size_t strlcat(dst, src, siz) register size_t n = siz; size_t dlen; - /* Find the end of dst and adjust bytes left */ - while (*d != '\0' && n != 0) + /* Find the end of dst and adjust bytes left but don't go past end */ + while (*d != '\0' && n-- != 0) d++; dlen = d - dst; - n -= dlen; + n = siz - dlen; if (n == 0) return(dlen + strlen(s)); -- cgit v1.2.3-59-g8ed1b