Just another udev segfault. strlcpy() writes behind the specified maximum
size. strlcat() causes the same probelem and truncates the destination string
to the maximum size which isn't the job for a concatenation function.
Thanks,
Kay
diff -Nru a/klibc/klibc/strlcat.c b/klibc/klibc/strlcat.c
--- a/klibc/klibc/strlcat.c 2005-03-27 04:40:42 +02:00
+++ b/klibc/klibc/strlcat.c 2005-03-27 04:40:42 +02:00
@@ -16,9 +16,11 @@
q++;
bytes++;
}
+ if (bytes == size)
+ return (bytes + strlen(src));
while ( (ch = *p++) ) {
- if ( bytes < size )
+ if ( bytes+1 < size )
*q++ = ch;
bytes++;
diff -Nru a/klibc/klibc/strlcpy.c b/klibc/klibc/strlcpy.c
--- a/klibc/klibc/strlcpy.c 2005-03-27 04:40:42 +02:00
+++ b/klibc/klibc/strlcpy.c 2005-03-27 04:40:42 +02:00
@@ -13,7 +13,7 @@
char ch;
while ( (ch = *p++) ) {
- if ( bytes < size )
+ if ( bytes+1 < size )
*q++ = ch;
bytes++;