From 6fcf2a941bd040d45ce22df49a1cd7c08eb3ec71 Mon Sep 17 00:00:00 2001
From: Theo de Raadt <deraadt@cvs.openbsd.org>
Date: Tue, 17 Feb 2009 22:53:44 +0000
Subject: when the template is entirely XXX characters, would crash from Vadim
 Zhukov <persgray@gmail ok millert

---
 lib/libc/stdio/mktemp.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'lib')

diff --git a/lib/libc/stdio/mktemp.c b/lib/libc/stdio/mktemp.c
index b88ef741fd7..dcc50b7f0f9 100644
--- a/lib/libc/stdio/mktemp.c
+++ b/lib/libc/stdio/mktemp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mktemp.c,v 1.24 2008/09/15 20:28:44 chl Exp $ */
+/*	$OpenBSD: mktemp.c,v 1.25 2009/02/17 22:53:43 deraadt Exp $ */
 /*
  * Copyright (c) 1987, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -100,9 +100,11 @@ _gettemp(char *path, int *doopen, int domkdir, int slen)
 	}
 	ep = path + len - slen;
 
-	for (start = ep; *--start == 'X';)
-		;
-	start++;
+	for (start = ep - 1; start != path; start--)
+		if (*start != 'X') {
+			start++;
+			break;
+		}
 
 	for (;;) {
 		for (cp = start; cp != ep; cp++) {
-- 
cgit v1.2.3