From: Rich Felker <dalias@aerifal.cx>
Date: Wed, 6 Apr 2011 16:35:05 +0000 (-0400)
Subject: fix completely bogus loop condition in getmntent_r
X-Git-Tag: v0.7.7~2
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=6b87e941f932a93120383de33f5237395fc1354a;p=oweals%2Fmusl.git

fix completely bogus loop condition in getmntent_r

somehow this worked on my simple fstab, but horribly broke in general,
leading to use of uninitialized offset array and crashes.
---

diff --git a/src/linux/mntent.c b/src/linux/mntent.c
index 26d045c2..48c85bd6 100644
--- a/src/linux/mntent.c
+++ b/src/linux/mntent.c
@@ -26,7 +26,7 @@ struct mntent *getmntent_r(FILE *f, struct mntent *mnt, char *linebuf, int bufle
 		cnt = sscanf(linebuf, " %n%*s%n %n%*s%n %n%*s%n %n%*s%n %d %d",
 			n, n+1, n+2, n+3, n+4, n+5, n+6, n+7,
 			&mnt->mnt_freq, &mnt->mnt_passno);
-	} while (cnt >= 8 && linebuf[n[0]] != '#');
+	} while (cnt < 2 || linebuf[n[0]] == '#');
 
 	linebuf[n[1]] = 0;
 	linebuf[n[3]] = 0;