Bug#741482: libc6: ptsname_r() can use uninitialized memory

[Jakub Wilk <jwilk@debian.org>]

Package: libc6
Version: 2.18-4

If the fd refers to a terminal device, but not a pty master, ptsname_r() 
passes the buffer (which would be normally uninitialized) unchanged to 
stat64:

$ cat test.c
#define _XOPEN_SOURCE
#include <stdlib.h>
int main(int argc, char **argv)
{
	char buffer[128] = "garbage";
	ptsname_r(0, buffer, sizeof buffer);
	return 0;
}

$ gcc test.c -o t

$ strace -o '| grep -B2 garbage' ./t
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, TIOCGPTN, [-142970892])        = -1 ENOTTY (Inappropriate ioctl for device)
stat64("garbage", 0xfffafe20)           = -1 ENOENT (No such file or directory)


-- System Information:
Debian Release: jessie/sid
 APT prefers unstable
 APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.12-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages libc6:i386 depends on:
ii  libgcc1  1:4.9-20140303-1

Versions of packages libc6:i386 recommends:
ii  libc6-i686  2.18-4

--
Jakub Wilk