From 1046090f1f0600d7298105f8226d4417918cb44d Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Mon, 4 Apr 2011 09:25:27 +0000 Subject: [PATCH] Do not increment num_args if strsep(3) returned an empty field. That fixes devstat_buildmatch(3) crashes with certain strings. Reported by: arundel MFC after: 2 weeks --- lib/libdevstat/devstat.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/libdevstat/devstat.c b/lib/libdevstat/devstat.c index d0ba704222c5..06d214858318 100644 --- a/lib/libdevstat/devstat.c +++ b/lib/libdevstat/devstat.c @@ -1014,11 +1014,12 @@ devstat_buildmatch(char *match_str, struct devstat_match **matches, * Break the (comma delimited) input string out into separate strings. */ for (tempstr = tstr, num_args = 0; - (*tempstr = strsep(&match_str, ",")) != NULL && (num_args < 5); - num_args++) - if (**tempstr != '\0') + (*tempstr = strsep(&match_str, ",")) != NULL && (num_args < 5);) + if (**tempstr != '\0') { + num_args++; if (++tempstr >= &tstr[5]) break; + } /* The user gave us too many type arguments */ if (num_args > 3) {