diff options
| author | brooks <brooks@FreeBSD.org> | 2016-01-13 21:50:08 +0000 |
|---|---|---|
| committer | brooks <brooks@FreeBSD.org> | 2016-01-13 21:50:08 +0000 |
| commit | e7eafcf596a620c405dc5f6d34749551cb2ab1e3 (patch) | |
| tree | ece8b5f7337e9a78c483e4734eca8510a53d2a5e /lib/libc/string | |
| parent | 50e4d892f3dd2bd28cc668736311dd1a3ad2a22d (diff) | |
| download | FreeBSD-src-e7eafcf596a620c405dc5f6d34749551cb2ab1e3.zip FreeBSD-src-e7eafcf596a620c405dc5f6d34749551cb2ab1e3.tar.gz | |
Avoid reading pass the end of the source buffer when it is not NUL
terminated.
If this buffer is adjacent to an unmapped page or a version of C with
bounds checked is used this may result in a crash.
PR: 206178
Submitted by: Alexander Cherepanov <cherepan@mccme.ru>
MFC after: 1 week
Diffstat (limited to 'lib/libc/string')
| -rw-r--r-- | lib/libc/string/wcslcat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libc/string/wcslcat.c b/lib/libc/string/wcslcat.c index f5f1e1e..2df9477 100644 --- a/lib/libc/string/wcslcat.c +++ b/lib/libc/string/wcslcat.c @@ -54,7 +54,7 @@ wcslcat(wchar_t *dst, const wchar_t *src, size_t siz) size_t dlen; /* Find the end of dst and adjust bytes left but don't go past end */ - while (*d != '\0' && n-- != 0) + while (n-- != 0 && *d != '\0') d++; dlen = d - dst; n = siz - dlen; |
