1 files changed, 22 insertions, 14 deletions

diff --git a/src/lib/libc/net/inet_neta.c b/src/lib/libc/net/inet_neta.c
index 881a328ab0..6960bcd0b5 100644
--- a/src/lib/libc/net/inet_neta.c
+++ b/src/lib/libc/net/inet_neta.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $   */
+/*      $OpenBSD: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $    */
 
 /*
  * Copyright (c) 1996 by Internet Software Consortium.
@@ -19,9 +19,9 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
-static const char rcsid[] = "$Id: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
+static const char rcsid[] = "$Id: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $";
 #else
-static const char rcsid[] = "$OpenBSD: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
+static const char rcsid[] = "$OpenBSD: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $";
 #endif
 #endif
 
@@ -52,29 +52,37 @@ inet_neta(src, dst, size)
         size_t size;
 {
         char *odst = dst;
-        char *tp;
+        char *ep;
+        int advance;
 
+        if (src == 0x00000000) {
+                if (size < sizeof "0.0.0.0")
+                        goto emsgsize;
+                strlcpy(dst, "0.0.0.0", size);
+                return dst;
+        }
+        ep = dst + size;
+        if (ep <= dst)
+                goto emsgsize;
         while (src & 0xffffffff) {
                 u_char b = (src & 0xff000000) >> 24;
 
                 src <<= 8;
-                if (b) {
-                        if (size < sizeof "255.")
+                if (b || src) {
+                        if (ep - dst < sizeof "255.")
+                                goto emsgsize;
+                        advance = snprintf(dst, ep - dst, "%u", b);
+                        if (advance <= 0 || advance >= ep - dst)
                                 goto emsgsize;
-                        tp = dst;
-                        dst += sprintf(dst, "%u", b);
+                        dst += advance;
                         if (src != 0L) {
+                                if (dst + 1 >= ep)
+                                        goto emsgsize;
                                 *dst++ = '.';
                                 *dst = '\0';
                         }
-                        size -= (size_t)(dst - tp);
                 }
         }
-        if (dst == odst) {
-                if (size < sizeof "0.0.0.0")
-                        goto emsgsize;
-                strlcpy(dst, "0.0.0.0", size);
-        }
         return (odst);
 
  emsgsize: