From owner-cvs-lib  Mon Mar 17 14:57:19 1997
Return-Path: <owner-cvs-lib>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id OAA10384
          for cvs-lib-outgoing; Mon, 17 Mar 1997 14:57:19 -0800 (PST)
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id OAA10374;
          Mon, 17 Mar 1997 14:57:06 -0800 (PST)
Received: (from bde@localhost) by godzilla.zeta.org.au (8.8.3/8.6.9) id JAA32577; Tue, 18 Mar 1997 09:55:22 +1100
Date: Tue, 18 Mar 1997 09:55:22 +1100
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199703172255.JAA32577@godzilla.zeta.org.au>
To: bde@zeta.org.au, guido@gvr.win.tue.nl
Subject: Re: cvs commit:  src/lib/libtermcap tgoto.c
Cc: cvs-all@freefall.freebsd.org, CVS-committers@freefall.freebsd.org,
        cvs-lib@freefall.freebsd.org, eivind@freefall.freebsd.org
Sender: owner-cvs-lib@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

>> >I think the if statements should be something like:
>> >if (dp >= &result[MAXRETURNSIZE-1])
>> 
>> This would ensure space for the terminator, but the check at the end
>> already does that.
>
>What check? I don;t see any check. According to me, the complete buffer

The one before the final `return ("OVERFLOW");', of course.

>can now be filled with non-NUL bytes and afterwards even extended by 
>sizeof(added). If added is "", then still the NUL would be one off.

It can be filled with non-NUL bytes, in which case the check will fail
(modulo the bug in the check that dp+strlen(added)+1 is invalid if dp
is at the end).

Bruce