Don't access buf[strlen(buf) - 1] for zero-length strings.

OK jaredy@.

5 files changed, 21 insertions, 12 deletions

diff --git a/usr.bin/less/filename.c b/usr.bin/less/filename.c
index ede2c6e1cb9..1c499e99411 100644
--- a/usr.bin/less/filename.c
+++ b/usr.bin/less/filename.c
@@ -676,7 +676,8 @@ lglob(filename)
 	/*
 	 * Overwrite the final trailing space with a null terminator.
 	 */
-	gfilename[strlen(gfilename) - 1] = '\0';
+	if (gfilename[0] != '\0' && gfilename[strlen(gfilename) - 1] == ' ')
+		gfilename[strlen(gfilename) - 1] = '\0';
 	GLOB_LIST_DONE(list);
 }
 #else
diff --git a/usr.bin/lex/initscan.c b/usr.bin/lex/initscan.c
index 1b5c39a7db3..1de99680840 100644
--- a/usr.bin/lex/initscan.c
+++ b/usr.bin/lex/initscan.c
@@ -1,10 +1,10 @@
-/*	$OpenBSD: initscan.c,v 1.10 2003/06/04 17:34:44 millert Exp $	*/
+/*	$OpenBSD: initscan.c,v 1.11 2006/12/06 05:03:29 ray Exp $	*/
 
 #line 2 "scan.c"
 /* A lexical scanner generated by flex */
 
 /* Scanner skeleton version:
- * $Header: /cvs/OpenBSD/src/usr.bin/lex/initscan.c,v 1.10 2003/06/04 17:34:44 millert Exp $
+ * $Header: /cvs/OpenBSD/src/usr.bin/lex/initscan.c,v 1.11 2006/12/06 05:03:29 ray Exp $
  */
 
 #define FLEX_SCANNER
@@ -1277,7 +1277,7 @@ char *yytext;
  * PURPOSE.
  */
 
-/* $Header: /cvs/OpenBSD/src/usr.bin/lex/initscan.c,v 1.10 2003/06/04 17:34:44 millert Exp $ */
+/* $Header: /cvs/OpenBSD/src/usr.bin/lex/initscan.c,v 1.11 2006/12/06 05:03:29 ray Exp $ */
 
 #include "flexdef.h"
 #include "parse.h"
@@ -2052,7 +2052,8 @@ YY_RULE_SETUP
 #line 279 "scan.l"
 {
 			strlcpy( nmstr, yytext + 1, sizeof nmstr );
-			nmstr[strlen( nmstr ) - 1] = '\0';
+			if (nmstr[strlen(nmstr) - 1] == '"')
+				nmstr[strlen(nmstr) - 1] = '\0';
 			return NAME;
 			}
 	YY_BREAK
diff --git a/usr.bin/lex/scan.l b/usr.bin/lex/scan.l
index 695cea12a72..8f0fa2d2789 100644
--- a/usr.bin/lex/scan.l
+++ b/usr.bin/lex/scan.l
@@ -1,4 +1,4 @@
-/*	$OpenBSD: scan.l,v 1.8 2003/06/04 17:34:44 millert Exp $	*/
+/*	$OpenBSD: scan.l,v 1.9 2006/12/06 05:03:29 ray Exp $	*/
 
 /* scan.l - scanner for flex input */
 
@@ -34,7 +34,7 @@
  * PURPOSE.
  */
 
-/* $Header: /cvs/OpenBSD/src/usr.bin/lex/scan.l,v 1.8 2003/06/04 17:34:44 millert Exp $ */
+/* $Header: /cvs/OpenBSD/src/usr.bin/lex/scan.l,v 1.9 2006/12/06 05:03:29 ray Exp $ */
 
 #include "flexdef.h"
 #include "parse.h"
@@ -285,7 +285,8 @@ LEXOPT		[aceknopr]
 
 	\"[^"\n]*\"	{
 			strlcpy( nmstr, yytext + 1, sizeof nmstr);
-			nmstr[strlen( nmstr ) - 1] = '\0';
+			if (nmstr[strlen(nmstr) - 1] == '"')
+				nmstr[strlen(nmstr) - 1] = '\0';
 			return NAME;
 			}
 
diff --git a/usr.bin/sectok/cyberflex.c b/usr.bin/sectok/cyberflex.c
index 8cf1e9d0255..302e0908dcb 100644
--- a/usr.bin/sectok/cyberflex.c
+++ b/usr.bin/sectok/cyberflex.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cyberflex.c,v 1.26 2004/03/15 15:03:11 aaron Exp $ */
+/*	$OpenBSD: cyberflex.c,v 1.27 2006/12/06 05:03:29 ray Exp $ */
 
 /*
  * copyright 1999, 2000
@@ -480,6 +480,7 @@ acl(int argc, char *argv[])
 	}
 
 	if (argc - optind < 1) {
+ usage:
 		printf("usage: acl [-x] fid [principal: r1 r2 ...]\n");
 		return -1;
 	}
@@ -511,7 +512,10 @@ acl(int argc, char *argv[])
 	prin = argv[optind++];
 
 	/* strip trailing ':' */
-	prin[strlen(prin) - 1] = '\0';
+	if (prin[0] != '\0' && prin[strlen(prin) - 1] == ':')
+		prin[strlen(prin) - 1] = '\0';
+	else
+		goto usage;
 
 	/* Find principal */
 	for (prno = 0; prno < 8; prno++)
diff --git a/usr.bin/sort/tmp.c b/usr.bin/sort/tmp.c
index 6e13b84ab80..c9a4471da6d 100644
--- a/usr.bin/sort/tmp.c
+++ b/usr.bin/sort/tmp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tmp.c,v 1.6 2003/06/10 22:20:51 deraadt Exp $	*/
+/*	$OpenBSD: tmp.c,v 1.7 2006/12/06 05:03:29 ray Exp $	*/
 
 /*-
  * Copyright (c) 1993
@@ -36,7 +36,7 @@
 #if 0
 static char sccsid[] = "@(#)tmp.c	8.1 (Berkeley) 6/6/93";
 #else
-static char rcsid[] = "$OpenBSD: tmp.c,v 1.6 2003/06/10 22:20:51 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: tmp.c,v 1.7 2006/12/06 05:03:29 ray Exp $";
 #endif
 #endif /* not lint */
 
@@ -65,6 +65,8 @@ ftmp(void)
 	char pathb[PATH_MAX], *path;
 
 	path = pathb;
+	if (tmpdir[0] == '\0')
+		errx(2, "invalid temporary directory: \"\"");
 	(void)snprintf(path, sizeof(pathb), "%s%s%s", tmpdir,
 		       (tmpdir[strlen(tmpdir)-1] != '/') ? "/" : "", _NAME_TMP);