In the case of a zero length string being returned by fgets(), the condition
checking for a trailing new line would perform a bad memory access outside
of `buf`. This might happen when line with a leading null byte is read.
Avoid this case by checking that the string has a length of at least one
byte. Also change the unsigned int types to size_t to store length values
while we're at it.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
*/
char *file_read_line_alloc(FILE * fp)
{
+ size_t buf_len, line_size;
char buf[BUFSIZ];
- unsigned int buf_len;
char *line = NULL;
- unsigned int line_size = 0;
int got_nl = 0;
- buf[0] = '\0';
-
while (fgets(buf, BUFSIZ, fp)) {
buf_len = strlen(buf);
- if (buf[buf_len - 1] == '\n') {
+ if (buf_len > 0 && buf[buf_len - 1] == '\n') {
buf_len--;
buf[buf_len] = '\0';
got_nl = 1;