[klibc] fix broken strlcpy() strlcat()

Kay Sievers kay.sievers at vrfy.org
Sat Mar 26 18:54:27 PST 2005


Just another udev segfault. strlcpy() writes behind the specified maximum
size. strlcat() causes the same probelem and truncates the destination string
to the maximum size which isn't the job for a concatenation function.

Thanks,
Kay


diff -Nru a/klibc/klibc/strlcat.c b/klibc/klibc/strlcat.c
--- a/klibc/klibc/strlcat.c	2005-03-27 04:40:42 +02:00
+++ b/klibc/klibc/strlcat.c	2005-03-27 04:40:42 +02:00
@@ -16,9 +16,11 @@
     q++;
     bytes++;
   }
+  if (bytes == size)
+    return (bytes + strlen(src));
 
   while ( (ch = *p++) ) {
-    if ( bytes < size )
+    if ( bytes+1 < size )
       *q++ = ch;
 
     bytes++;
diff -Nru a/klibc/klibc/strlcpy.c b/klibc/klibc/strlcpy.c
--- a/klibc/klibc/strlcpy.c	2005-03-27 04:40:42 +02:00
+++ b/klibc/klibc/strlcpy.c	2005-03-27 04:40:42 +02:00
@@ -13,7 +13,7 @@
   char ch;
 
   while ( (ch = *p++) ) {
-    if ( bytes < size )
+    if ( bytes+1 < size )
       *q++ = ch;
 
     bytes++;



More information about the klibc mailing list