When finding the end of dst, never traverse more than siz bytes. This

keeps us from misbehaving if the user gives us a src string that is not
NUL-terminated.  This is one of those "should not happen" cases but it
is good to play it safe.  Pointed out by Casper Dik <casper@holland.sun.com>

1 files changed, 5 insertions, 5 deletions

diff --git a/src/lib/libc/string/strlcat.c b/src/lib/libc/string/strlcat.c
index 2e8c56926e..599994edf5 100644
--- a/src/lib/libc/string/strlcat.c
+++ b/src/lib/libc/string/strlcat.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: strlcat.c,v 1.1 1998/07/01 01:29:45 millert Exp $     */
+/*      $OpenBSD: strlcat.c,v 1.2 1999/06/17 16:28:58 millert Exp $     */
 
 /*
  * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -28,7 +28,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strlcat.c,v 1.1 1998/07/01 01:29:45 millert Exp $";
+static char *rcsid = "$OpenBSD: strlcat.c,v 1.2 1999/06/17 16:28:58 millert Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/types.h>
@@ -50,11 +50,11 @@ size_t strlcat(dst, src, siz)
         register size_t n = siz;
         size_t dlen;
 
-        /* Find the end of dst and adjust bytes left */
-        while (*d != '\0' && n != 0)
+        /* Find the end of dst and adjust bytes left but don't go past end */
+        while (*d != '\0' && n-- != 0)
                 d++;
         dlen = d - dst;
-        n -= dlen;
+        n = siz - dlen;
 
         if (n == 0)
                 return(dlen + strlen(s));