More stupidity *sigh*

diff --git a/src/lib/util/pcap.c b/src/lib/util/pcap.c
index c43ae6204dea2f482d3fe3301dc4dc0026ba6aa1..6ee74d0a0394e4db2749b0120b757ddd8a160147 100644 (file)
--- a/src/lib/util/pcap.c
+++ b/src/lib/util/pcap.c
@@ -26,6 +26,7 @@
 #include <freeradius-devel/util/net.h>
 #include <freeradius-devel/util/pair.h>
 #include <freeradius-devel/util/pcap.h>
+#include <freeradius-devel/util/print.h>
 #include <freeradius-devel/util/syserror.h>
 #include <freeradius-devel/util/talloc.h>
 
@@ -429,32 +430,36 @@ int fr_pcap_apply_filter(fr_pcap_t *pcap, char const *expression)
 char *fr_pcap_device_names(TALLOC_CTX *ctx, fr_pcap_t *pcap, char c)
 {
        fr_pcap_t *pcap_p;
-       char *buff, *p;
-       size_t len = 0, left = 0, wrote;
+       char *buff, *p, *end;
+       size_t len = 0;
 
        if (!pcap) {
-               goto null;
+       null:
+               return talloc_zero_array(ctx, char, 1);
        }
 
        for (pcap_p = pcap;
             pcap_p;
             pcap_p = pcap_p->next) {
-               len += talloc_array_length(pcap_p->name);       // Talloc array length includes the \0
+               /*
+                *      talloc_array_length includes \0 which accounts for c
+                */
+               len += talloc_array_length(pcap_p->name);
        }
 
-       if (!len) {
-       null:
-               return talloc_zero_array(ctx, char, 1);
-       }
+       if (!len) goto null;
+
+       buff = p = talloc_zero_array(ctx, char, len + 1);
+       end = p + len;
 
-       left = len + 1;
-       buff = p = talloc_zero_array(ctx, char, left);
        for (pcap_p = pcap;
             pcap_p;
             pcap_p = pcap_p->next) {
-               wrote = snprintf(p, left, "%s%c", pcap_p->name, c);
-               left -= wrote;
-               p += wrote;
+               size_t ret;
+
+               ret = snprintf(p, end - p, "%s%c", pcap_p->name, c);
+               rad_assert(!is_truncated(ret, end - p));                /* Static analysis */
+               p += ret;
        }
        buff[len - 1] = '\0';