fts_open() requires that the list passed as argument to contain at least

one path.  When the list is empty (contain only a NULL pointer), return
EINVAL instead of pretending to succeed, which will cause a NULL pointer
deference in a later fts_read() call.

Noticed by:	Christoph Mallon (via rdivacky@)
MFC after:	2 weeks

2 files changed, 8 insertions, 2 deletions

diff --git a/lib/libc/gen/fts.3 b/lib/libc/gen/fts.3
index 8e1a1e4..dfe2de0 100644
--- a/lib/libc/gen/fts.3
+++ b/lib/libc/gen/fts.3
@@ -28,7 +28,7 @@
 .\"     @(#)fts.3	8.5 (Berkeley) 4/16/94
 .\" $FreeBSD$
 .\"
-.Dd January 26, 2008
+.Dd October 5, 2009
 .Dt FTS 3
 .Os
 .Sh NAME
@@ -776,7 +776,7 @@ may fail and set
 as follows:
 .Bl -tag -width Er
 .It Bq Er EINVAL
-The options were invalid.
+The options were invalid, or the list were empty.
 .El
 .Sh SEE ALSO
 .Xr find 1 ,
diff --git a/lib/libc/gen/fts.c b/lib/libc/gen/fts.c
index 41443c5..392bda9 100644
--- a/lib/libc/gen/fts.c
+++ b/lib/libc/gen/fts.c
@@ -124,6 +124,12 @@ fts_open(argv, options, compar)
 		return (NULL);
 	}
 
+	/* fts_open() requires at least one path */
+	if (*argv == NULL) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
 	/* Allocate/initialize the stream. */
 	if ((priv = malloc(sizeof(*priv))) == NULL)
 		return (NULL);