lkml.org 
[lkml]   [2011]   [Oct]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [slabinfo PATCH] Fix off-by-one after readlink() call
On 10/14/2011 07:16 PM, Christoph Lameter wrote:
>> index 868cc93..cc1a378 100644
>> --- a/tools/slub/slabinfo.c
>> +++ b/tools/slub/slabinfo.c
>> @@ -1145,7 +1145,7 @@ static void read_slab_dir(void)
>> switch (de->d_type) {
>> case DT_LNK:
>> alias->name = strdup(de->d_name);
>> - count = readlink(de->d_name, buffer, sizeof(buffer));
>> + count = readlink(de->d_name, buffer, sizeof(buffer)-1);
>>
>
> DESCRIPTION
> readlink() places the contents of the symbolic link path in the buffer buf, which has size bufsiz. readlink() does not append a
> null byte to buf. It will truncate the contents (to a length of bufsiz characters), in case the buffer is too small to hold all of
> the contents.

The problem is the line after the readlink() call:

buffer[count] = '\0';

The common technique is to reduce the buffer size by one.
Another fix would be to check

"
if (count < 0 || count == sizeof(buffer))
fatal();
"

Reducing the buffer size by one is easier IMHO.

Cheers,
Thomas


\
 
 \ /
  Last update: 2011-10-14 19:29    [W:0.339 / U:0.764 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site