diff options
author | brooks <brooks@FreeBSD.org> | 2016-01-13 21:49:01 +0000 |
---|---|---|
committer | brooks <brooks@FreeBSD.org> | 2016-01-13 21:49:01 +0000 |
commit | 50e4d892f3dd2bd28cc668736311dd1a3ad2a22d (patch) | |
tree | 8b20e810cebe226e764bb71f98eef7b4142f5366 | |
parent | 1212c000b3276180ad46708010f41ad56adeea7b (diff) | |
download | FreeBSD-src-50e4d892f3dd2bd28cc668736311dd1a3ad2a22d.zip FreeBSD-src-50e4d892f3dd2bd28cc668736311dd1a3ad2a22d.tar.gz |
Avoid reading pass the end of the source buffer when it is not NUL
terminated.
If this buffer is adjacent to an unmapped page or a version of C with
bounds checked is used this may result in a crash.
PR: 206177
Submitted by: Alexander Cherepanov <cherepan@mccme.ru>
MFC after: 1 week
-rw-r--r-- | lib/libc/string/wcsncat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libc/string/wcsncat.c b/lib/libc/string/wcsncat.c index 44f1ff9..5a24347 100644 --- a/lib/libc/string/wcsncat.c +++ b/lib/libc/string/wcsncat.c @@ -48,7 +48,7 @@ wcsncat(wchar_t * __restrict s1, const wchar_t * __restrict s2, size_t n) p++; q = p; r = s2; - while (*r && n) { + while (n && *r) { *q++ = *r++; n--; } |