From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 20 Sep 2019 16:51:47 +0000 (-0500)
Subject: More stupidity *sigh*
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fa4f9407adb661460164fcbe2d8eadb0b3576a07;p=thirdparty%2Ffreeradius-server.git

More stupidity *sigh*
---

diff --git a/src/lib/util/pcap.c b/src/lib/util/pcap.c
index c43ae6204de..6ee74d0a039 100644
--- a/src/lib/util/pcap.c
+++ b/src/lib/util/pcap.c
@@ -26,6 +26,7 @@
 #include <freeradius-devel/util/net.h>
 #include <freeradius-devel/util/pair.h>
 #include <freeradius-devel/util/pcap.h>
+#include <freeradius-devel/util/print.h>
 #include <freeradius-devel/util/syserror.h>
 #include <freeradius-devel/util/talloc.h>
 
@@ -429,32 +430,36 @@ int fr_pcap_apply_filter(fr_pcap_t *pcap, char const *expression)
 char *fr_pcap_device_names(TALLOC_CTX *ctx, fr_pcap_t *pcap, char c)
 {
 	fr_pcap_t *pcap_p;
-	char *buff, *p;
-	size_t len = 0, left = 0, wrote;
+	char *buff, *p, *end;
+	size_t len = 0;
 
 	if (!pcap) {
-		goto null;
+	null:
+		return talloc_zero_array(ctx, char, 1);
 	}
 
 	for (pcap_p = pcap;
 	     pcap_p;
 	     pcap_p = pcap_p->next) {
-		len += talloc_array_length(pcap_p->name);	// Talloc array length includes the \0
+	     	/*
+	     	 *	talloc_array_length includes \0 which accounts for c
+	     	 */
+		len += talloc_array_length(pcap_p->name);
 	}
 
-	if (!len) {
-	null:
-		return talloc_zero_array(ctx, char, 1);
-	}
+	if (!len) goto null;
+
+	buff = p = talloc_zero_array(ctx, char, len + 1);
+	end = p + len;
 
-	left = len + 1;
-	buff = p = talloc_zero_array(ctx, char, left);
 	for (pcap_p = pcap;
 	     pcap_p;
 	     pcap_p = pcap_p->next) {
-		wrote = snprintf(p, left, "%s%c", pcap_p->name, c);
-		left -= wrote;
-		p += wrote;
+	     	size_t ret;
+
+		ret = snprintf(p, end - p, "%s%c", pcap_p->name, c);
+		rad_assert(!is_truncated(ret, end - p));		/* Static analysis */
+		p += ret;
 	}
 	buff[len - 1] = '\0';