summaryrefslogtreecommitdiff
path: root/src/linux/mntent.c
diff options
context:
space:
mode:
authorRich Felker <dalias@aerifal.cx>2011-04-06 12:35:05 -0400
committerRich Felker <dalias@aerifal.cx>2011-04-06 12:35:05 -0400
commit6b87e941f932a93120383de33f5237395fc1354a (patch)
tree03505ce053cb81f85493977dd681db728e2a71b6 /src/linux/mntent.c
parenta113434cd68ce30642c4995b1caadcd084be6f09 (diff)
downloadmusl-6b87e941f932a93120383de33f5237395fc1354a.tar.gz
fix completely bogus loop condition in getmntent_r
somehow this worked on my simple fstab, but horribly broke in general, leading to use of uninitialized offset array and crashes.
Diffstat (limited to 'src/linux/mntent.c')
-rw-r--r--src/linux/mntent.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/linux/mntent.c b/src/linux/mntent.c
index 26d045c2..48c85bd6 100644
--- a/src/linux/mntent.c
+++ b/src/linux/mntent.c
@@ -26,7 +26,7 @@ struct mntent *getmntent_r(FILE *f, struct mntent *mnt, char *linebuf, int bufle
cnt = sscanf(linebuf, " %n%*s%n %n%*s%n %n%*s%n %n%*s%n %d %d",
n, n+1, n+2, n+3, n+4, n+5, n+6, n+7,
&mnt->mnt_freq, &mnt->mnt_passno);
- } while (cnt >= 8 && linebuf[n[0]] != '#');
+ } while (cnt < 2 || linebuf[n[0]] == '#');
linebuf[n[1]] = 0;
linebuf[n[3]] = 0;