Index: stable/11/lib/libc/net/linkaddr.c
===================================================================
--- stable/11/lib/libc/net/linkaddr.c	(revision 309643)
+++ stable/11/lib/libc/net/linkaddr.c	(revision 309644)
@@ -1,153 +1,170 @@
 /*-
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 4. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static char sccsid[] = "@(#)linkaddr.c	8.1 (Berkeley) 6/4/93";
 #endif /* LIBC_SCCS and not lint */
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
 #include <sys/types.h>
 #include <sys/socket.h>
+#include <net/if.h>
 #include <net/if_dl.h>
 #include <string.h>
 
 /* States*/
 #define NAMING	0
 #define GOTONE	1
 #define GOTTWO	2
 #define RESET	3
 /* Inputs */
 #define	DIGIT	(4*0)
 #define	END	(4*1)
 #define DELIM	(4*2)
 #define LETTER	(4*3)
 
 void
 link_addr(const char *addr, struct sockaddr_dl *sdl)
 {
 	char *cp = sdl->sdl_data;
 	char *cplim = sdl->sdl_len + (char *)sdl;
 	int byte = 0, state = NAMING, new;
 
 	bzero((char *)&sdl->sdl_family, sdl->sdl_len - 1);
 	sdl->sdl_family = AF_LINK;
 	do {
 		state &= ~LETTER;
 		if ((*addr >= '0') && (*addr <= '9')) {
 			new = *addr - '0';
 		} else if ((*addr >= 'a') && (*addr <= 'f')) {
 			new = *addr - 'a' + 10;
 		} else if ((*addr >= 'A') && (*addr <= 'F')) {
 			new = *addr - 'A' + 10;
 		} else if (*addr == 0) {
 			state |= END;
 		} else if (state == NAMING &&
 			   (((*addr >= 'A') && (*addr <= 'Z')) ||
 			   ((*addr >= 'a') && (*addr <= 'z'))))
 			state |= LETTER;
 		else
 			state |= DELIM;
 		addr++;
 		switch (state /* | INPUT */) {
 		case NAMING | DIGIT:
 		case NAMING | LETTER:
 			*cp++ = addr[-1];
 			continue;
 		case NAMING | DELIM:
 			state = RESET;
 			sdl->sdl_nlen = cp - sdl->sdl_data;
 			continue;
 		case GOTTWO | DIGIT:
 			*cp++ = byte;
 			/* FALLTHROUGH */
 		case RESET | DIGIT:
 			state = GOTONE;
 			byte = new;
 			continue;
 		case GOTONE | DIGIT:
 			state = GOTTWO;
 			byte = new + (byte << 4);
 			continue;
 		default: /* | DELIM */
 			state = RESET;
 			*cp++ = byte;
 			byte = 0;
 			continue;
 		case GOTONE | END:
 		case GOTTWO | END:
 			*cp++ = byte;
 			/* FALLTHROUGH */
 		case RESET | END:
 			break;
 		}
 		break;
 	} while (cp < cplim);
 	sdl->sdl_alen = cp - LLADDR(sdl);
 	new = cp - (char *)sdl;
 	if (new > sizeof(*sdl))
 		sdl->sdl_len = new;
 	return;
 }
 
 static const char hexlist[] = "0123456789abcdef";
 
 char *
 link_ntoa(const struct sockaddr_dl *sdl)
 {
 	static char obuf[64];
-	char *out = obuf;
-	int i;
-	u_char *in = (u_char *)LLADDR(sdl);
-	u_char *inlim = in + sdl->sdl_alen;
-	int firsttime = 1;
+	_Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
+	char *out;
+	const char *in, *inlim;
+	int namelen, i, rem;
 
-	if (sdl->sdl_nlen) {
-		bcopy(sdl->sdl_data, obuf, sdl->sdl_nlen);
-		out += sdl->sdl_nlen;
-		if (sdl->sdl_alen)
+	namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
+
+	out = obuf;
+	rem = sizeof(obuf);
+	if (namelen > 0) {
+		bcopy(sdl->sdl_data, out, namelen);
+		out += namelen;
+		rem -= namelen;
+		if (sdl->sdl_alen > 0) {
 			*out++ = ':';
+			rem--;
+		}
 	}
-	while (in < inlim) {
-		if (firsttime)
-			firsttime = 0;
-		else
+
+	in = (const char *)sdl->sdl_data + sdl->sdl_nlen;
+	inlim = in + sdl->sdl_alen;
+
+	while (in < inlim && rem > 1) {
+		if (in != (const char *)sdl->sdl_data + sdl->sdl_nlen) {
 			*out++ = '.';
+			rem--;
+		}
 		i = *in++;
 		if (i > 0xf) {
-			out[1] = hexlist[i & 0xf];
+			if (rem < 3)
+				break;
+			*out++ = hexlist[i & 0xf];
 			i >>= 4;
-			out[0] = hexlist[i];
-			out += 2;
-		} else
 			*out++ = hexlist[i];
+			rem -= 2;
+		} else {
+			if (rem < 2)
+				break;
+			*out++ = hexlist[i];
+			rem++;
+		}
 	}
 	*out = 0;
 	return (obuf);
 }
Index: stable/11
===================================================================
--- stable/11	(revision 309643)
+++ stable/11	(revision 309644)

Property changes on: stable/11
___________________________________________________________________
Modified: svn:mergeinfo
## -0,0 +0,1 ##
   Merged /head:r309639