mdconfig core dump

Tonight, on a world compiled from last night's sources, mdconfig(8)
started dumping cores for me.  The stack trace was:

#0  0x080491da in strsep ()
#1  0x08048961 in list (fd=3) at /usr/src/sbin/mdconfig/mdconfig.c:219
#2  0x080487cc in main (argc=2, argv=0xbfbffaf0) at
    /usr/src/sbin/mdconfig/mdconfig.c:176
#3  0x08048139 in _start ()

Does the following look a reasonable change?  It seems that strsep()
starts getting angry when fed a non-nul-terminated buffer.

%%%
Index: mdconfig.c
===================================================================
RCS file: /home/ncvs/src/sbin/mdconfig/mdconfig.c,v
retrieving revision 1.23
diff -u -r1.23 mdconfig.c
--- mdconfig.c	21 Aug 2002 15:15:15 -0000	1.23
+++ mdconfig.c	9 Oct 2002 22:01:19 -0000
@@ -211,8 +211,9 @@
 
 	if (sysctlbyname("kern.disks", NULL, &dll, NULL, 0) == -1)
 		err(1, "sysctlbyname: kern.disks");
-	if ( (disklist = malloc(dll)) == NULL)
+	if ( (disklist = malloc(dll + 1)) == NULL)
 		err(1, "malloc");
+	bzero(disklist, dll + 1);
 	if (sysctlbyname("kern.disks", disklist, &dll, NULL, 0) == -1)
 		err(1, "sysctlbyname: kern.disks");
 
%%%

To Unsubscribe: send mail to [email protected]
with "unsubscribe freebsd-audit" in the body of the message