Messages in this thread | | | Date | Fri, 14 Oct 2011 19:26:00 +0200 | From | Thomas Jarosch <> | Subject | Re: [slabinfo PATCH] Fix off-by-one after readlink() call |
| |
On 10/14/2011 07:16 PM, Christoph Lameter wrote: >> index 868cc93..cc1a378 100644 >> --- a/tools/slub/slabinfo.c >> +++ b/tools/slub/slabinfo.c >> @@ -1145,7 +1145,7 @@ static void read_slab_dir(void) >> switch (de->d_type) { >> case DT_LNK: >> alias->name = strdup(de->d_name); >> - count = readlink(de->d_name, buffer, sizeof(buffer)); >> + count = readlink(de->d_name, buffer, sizeof(buffer)-1); >> > > DESCRIPTION > readlink() places the contents of the symbolic link path in the buffer buf, which has size bufsiz. readlink() does not append a > null byte to buf. It will truncate the contents (to a length of bufsiz characters), in case the buffer is too small to hold all of > the contents.
The problem is the line after the readlink() call:
buffer[count] = '\0';
The common technique is to reduce the buffer size by one. Another fix would be to check
" if (count < 0 || count == sizeof(buffer)) fatal(); "
Reducing the buffer size by one is easier IMHO.
Cheers, Thomas
| |