Security: fl_directory_list() is not appending a NULL.

If any of these strings are passed to standard library functions that expect NULL terminated strings, then an invalid read access can occur.

diff --git a/level_1/fl_directory/c/private-directory.c b/level_1/fl_directory/c/private-directory.c
index 42bee9d976d96812323a71f3dbd83c4c654ea826..55f4eb2c3b3f3b39a13e769d34117f686d86d3f4 100644 (file)
--- a/level_1/fl_directory/c/private-directory.c
+++ b/level_1/fl_directory/c/private-directory.c
@@ -543,10 +543,11 @@ extern "C" {
 
       names->array[names->used].used = 0;
 
-      status = f_string_dynamic_increase_by(name_directory.used, &names->array[names->used]);
+      status = f_string_dynamic_increase_by(name_directory.used + 1, &names->array[names->used]);
       if (F_status_is_error(status)) break;
 
       memcpy(names->array[names->used].string, name_directory.string, sizeof(f_char_t) * name_directory.used);
+      names->array[names->used].string[name_directory.used] = 0;
       names->array[names->used++].used = name_directory.used;
 
       f_memory_resize(1, 0, sizeof(f_char_t *), (void **) & entity[i]);