fts_open() requires that the list passed as argument to contain at least

one path.  When the list is empty (contain only a NULL pointer), return
EINVAL instead of pretending to succeed, which will cause a NULL pointer
deference in a later fts_read() call.  From FreeBSD.

2 files changed, 12 insertions, 4 deletions

diff --git a/lib/libc/gen/fts.3 b/lib/libc/gen/fts.3
index 53812b3f06a..784b2801cb3 100644
--- a/lib/libc/gen/fts.3
+++ b/lib/libc/gen/fts.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: fts.3,v 1.34 2015/11/10 23:48:18 jmc Exp $
+.\"	$OpenBSD: fts.3,v 1.35 2016/06/28 17:21:48 millert Exp $
 .\"
 .\" Copyright (c) 1989, 1991, 1993, 1994
 .\"	The Regents of the University of California.  All rights reserved.
@@ -29,7 +29,7 @@
 .\"
 .\"     @(#)fts.3	8.5 (Berkeley) 4/16/94
 .\"
-.Dd $Mdocdate: November 10 2015 $
+.Dd $Mdocdate: June 28 2016 $
 .Dt FTS_OPEN 3
 .Os
 .Sh NAME
@@ -762,7 +762,9 @@ may fail and set
 as follows:
 .Bl -tag -width Er
 .It Bq Er EINVAL
-The specified option is invalid.
+The specified option is invalid or
+.Fa path_argv
+is empty.
 .El
 .Sh SEE ALSO
 .Xr find 1 ,
diff --git a/lib/libc/gen/fts.c b/lib/libc/gen/fts.c
index ee3a5ba2dc8..9a9b2a5a5cd 100644
--- a/lib/libc/gen/fts.c
+++ b/lib/libc/gen/fts.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fts.c,v 1.54 2016/06/28 17:12:29 millert Exp $	*/
+/*	$OpenBSD: fts.c,v 1.55 2016/06/28 17:21:48 millert Exp $	*/
 
 /*-
  * Copyright (c) 1990, 1993, 1994
@@ -82,6 +82,12 @@ fts_open(char * const *argv, int options,
 		return (NULL);
 	}
 
+	/* At least one path must be specified. */
+	if (*argv == NULL) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
 	/* Allocate/initialize the stream */
 	if ((sp = calloc(1, sizeof(FTS))) == NULL)
 		return (NULL);