Lib: Don't trust sscanf()'s %n argument

Don't trust sscanf()'s %n argument just in case the space immediately before
it didn't match anything as sscanf() doesn't tell you if it was set.

Signed-off-by: David Howells <dhowells@redhat.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/keyutils.c b/keyutils.c
index 555df55..3922d63 100644
--- a/keyutils.c
+++ b/keyutils.c
@@ -472,9 +472,10 @@ key_serial_t find_key_by_type_and_desc(const char *type, const char *desc,
 		if (*cp)
 			*cp = '\0';
 
+		ndesc = 0;
 		n = sscanf(buf, "%x %*s %*u %*s %*x %*d %*d %s %n",
 			   &id, typebuf, &ndesc);
-		if (n == 2) {
+		if (n == 2 && ndesc > 0 && ndesc <= cp - buf) {
 			if (strcmp(typebuf, type) != 0)
 				continue;
 			kdesc = buf + ndesc;