Security: fl_directory_list() is not appending a NULL.

If any of these strings are passed to standard library functions that expect NULL terminated strings, then an invalid read access can occur.

diff --git a/level_1/fl_directory/c/private-directory.c b/level_1/fl_directory/c/private-directory.c
index 30e901e922994a0d0016e9585fdcbdb829e610ac..a6e63a6965bc25f4a40158f29ed6e6576b5524ec 100644 (file)
--- a/level_1/fl_directory/c/private-directory.c
+++ b/level_1/fl_directory/c/private-directory.c
@@ -693,10 +693,11 @@ extern "C" {
 
       names->array[names->used].used = 0;
 
-      status = f_string_dynamic_increase_by(name_directory.used, &names->array[names->used]);
+      status = f_string_dynamic_increase_by(name_directory.used + 1, &names->array[names->used]);
       if (F_status_is_error(status)) break;
 
       memcpy(names->array[names->used].string, name_directory.string, sizeof(f_char_t) * name_directory.used);
+      names->array[names->used].string[name_directory.used] = 0;
       names->array[names->used++].used = name_directory.used;
 
       f_memory_resize(1, 0, sizeof(f_char_t *), (void **) & entity[i]);