In rev 1.15 the sizeof argument was fixed in a strlcat() call but

the truncation check immediately following it was not updated to
match.  Not an issue in practice since the buffers are the same
size.  OK deraadt@

diff --git a/lib/libc/stdlib/realpath.c b/lib/libc/stdlib/realpath.c
index 7b70b9d..27f1a29 100644 (file)
--- a/lib/libc/stdlib/realpath.c
+++ b/lib/libc/stdlib/realpath.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: realpath.c,v 1.19 2015/01/16 16:48:51 deraadt Exp $ */
+/*     $OpenBSD: realpath.c,v 1.20 2015/10/13 20:55:37 millert Exp $ */
 /*
  * Copyright (c) 2003 Constantin S. Svintsoff <kostik@iclub.nsu.ru>
  *
@@ -190,7 +190,7 @@ realpath(const char *path, char *resolved)
                                        symlink[slen + 1] = 0;
                                }
                                left_len = strlcat(symlink, left, sizeof(symlink));
-                               if (left_len >= sizeof(left)) {
+                               if (left_len >= sizeof(symlink)) {
                                        errno = ENAMETOOLONG;
                                        goto err;
                                }