Fix regression in entry_to_env()

I broke entry_to_env() by incrementing the wrong variable in commit
a6bbd1d7f5c2 ("Fix potential buffer overflow in entry_to_env").

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/src/script.c b/src/script.c
index 357933105d35d56f5718fbad56b30595dbe80557..5955e940f075b9879609d3314377bfad0f7c0909 100644 (file)
--- a/src/script.c
+++ b/src/script.c
@@ -169,7 +169,7 @@ static void entry_to_env(const char *name, const void *data, size_t len, enum en
                buf_len += strlen(&buf[buf_len]);
                if (type != ENTRY_HOST) {
                        snprintf(&buf[buf_len], 6, "/%"PRIu16, e[i].length);
                buf_len += strlen(&buf[buf_len]);
                if (type != ENTRY_HOST) {
                        snprintf(&buf[buf_len], 6, "/%"PRIu16, e[i].length);

-                       buf += strlen(&buf[buf_len]);
+                       buf_len += strlen(&buf[buf_len]);

                        if (type == ENTRY_ROUTE) {
                                buf[buf_len++] = ',';
                                if (!IN6_IS_ADDR_UNSPECIFIED(&e[i].router)) {
                        if (type == ENTRY_ROUTE) {
                                buf[buf_len++] = ',';
                                if (!IN6_IS_ADDR_UNSPECIFIED(&e[i].router)) {


@@ -177,15 +177,15 @@ static void entry_to_env(const char *name, const void *data, size_t len, enum en
                                        buf_len += strlen(&buf[buf_len]);
                                }
                                snprintf(&buf[buf_len], 23, ",%u,%u", e[i].valid, e[i].priority);
                                        buf_len += strlen(&buf[buf_len]);
                                }
                                snprintf(&buf[buf_len], 23, ",%u,%u", e[i].valid, e[i].priority);

-                               buf += strlen(&buf[buf_len]);
+                               buf_len += strlen(&buf[buf_len]);

                        } else {
                                snprintf(&buf[buf_len], 23, ",%u,%u", e[i].preferred, e[i].valid);
                        } else {
                                snprintf(&buf[buf_len], 23, ",%u,%u", e[i].preferred, e[i].valid);

-                               buf += strlen(&buf[buf_len]);
+                               buf_len += strlen(&buf[buf_len]);

                        }
 
                        if (type == ENTRY_PREFIX && ntohl(e[i].iaid) != 1) {
                                snprintf(&buf[buf_len], 16, ",class=%08x", ntohl(e[i].iaid));
                        }
 
                        if (type == ENTRY_PREFIX && ntohl(e[i].iaid) != 1) {
                                snprintf(&buf[buf_len], 16, ",class=%08x", ntohl(e[i].iaid));

-                               buf += strlen(&buf[buf_len]);
+                               buf_len += strlen(&buf[buf_len]);

                        }
 
                        if (type == ENTRY_PREFIX && e[i].priority) {
                        }
 
                        if (type == ENTRY_PREFIX && e[i].priority) {