diff options
author | brooks <brooks@FreeBSD.org> | 2016-01-20 19:08:49 +0000 |
---|---|---|
committer | brooks <brooks@FreeBSD.org> | 2016-01-20 19:08:49 +0000 |
commit | e2eb05d1c781889c336a2514b104717f58ceddca (patch) | |
tree | 359c4a63e5ba9a5852b7c34b2da3fbe4e639b774 /lib | |
parent | 8ac497f63ee970f8afcee328597d87dbd1c93744 (diff) | |
download | FreeBSD-src-e2eb05d1c781889c336a2514b104717f58ceddca.zip FreeBSD-src-e2eb05d1c781889c336a2514b104717f58ceddca.tar.gz |
MFC r293855:
Avoid reading pass the end of the source buffer when it is not NUL
terminated.
If this buffer is adjacent to an unmapped page or a version of C with
bounds checked is used this may result in a crash.
PR: 206177
Submitted by: Alexander Cherepanov <cherepan@mccme.ru>
Diffstat (limited to 'lib')
-rw-r--r-- | lib/libc/string/wcsncat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libc/string/wcsncat.c b/lib/libc/string/wcsncat.c index 44f1ff9..5a24347 100644 --- a/lib/libc/string/wcsncat.c +++ b/lib/libc/string/wcsncat.c @@ -48,7 +48,7 @@ wcsncat(wchar_t * __restrict s1, const wchar_t * __restrict s2, size_t n) p++; q = p; r = s2; - while (*r && n) { + while (n && *r) { *q++ = *r++; n--; } |