diff options
| author | jedgar <jedgar@FreeBSD.org> | 2001-01-17 20:51:16 +0000 |
|---|---|---|
| committer | jedgar <jedgar@FreeBSD.org> | 2001-01-17 20:51:16 +0000 |
| commit | 3644801234941af6cb5e5938772a7d92049f3ee5 (patch) | |
| tree | 7f84beacca3a0014813bcdfa3307fed7c6ecd6d6 /sys/libkern | |
| parent | d4d18015b956e777b4e1eef1f1d86e0f3c4cb041 (diff) | |
| download | FreeBSD-src-3644801234941af6cb5e5938772a7d92049f3ee5.zip FreeBSD-src-3644801234941af6cb5e5938772a7d92049f3ee5.tar.gz | |
- Reverse the order of two loop invariant to ensure strlcat() does not
attempt to read memory when siz is 0
- Clarify comments referring to strlcat() usage
PR: 24278, 24295
Submitted by: Tony Finch <dot@dotat.at>
Richard Kettlewell <rjk@greenend.org.uk>
Reviewed by: -audit
Diffstat (limited to 'sys/libkern')
| -rw-r--r-- | sys/libkern/strlcat.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/sys/libkern/strlcat.c b/sys/libkern/strlcat.c index 599994e..5bc2c91 100644 --- a/sys/libkern/strlcat.c +++ b/sys/libkern/strlcat.c @@ -25,6 +25,8 @@ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ */ #if defined(LIBC_SCCS) && !defined(lint) @@ -37,8 +39,9 @@ static char *rcsid = "$OpenBSD: strlcat.c,v 1.2 1999/06/17 16:28:58 millert Exp /* * Appends src to string dst of size siz (unlike strncat, siz is the * full size of dst, not space left). At most siz-1 characters - * will be copied. Always NUL terminates (unless siz == 0). - * Returns strlen(src); if retval >= siz, truncation occurred. + * will be copied. Always NUL terminates (unless siz <= strlen(dst)). + * Returns strlen(initial dst) + strlen(src); if retval >= siz, + * truncation occurred. */ size_t strlcat(dst, src, siz) char *dst; @@ -51,7 +54,7 @@ size_t strlcat(dst, src, siz) size_t dlen; /* Find the end of dst and adjust bytes left but don't go past end */ - while (*d != '\0' && n-- != 0) + while (n-- != 0 && *d != '\0') d++; dlen = d - dst; n = siz - dlen; |
