Messages in this thread Patch in this message | | | From | Thomas Jarosch <> | Subject | [slabinfo PATCH v2] Fix off-by-one buffer corruption after readlink() call | Date | Mon, 17 Oct 2011 16:48:10 +0200 |
| |
readlink() never zero terminates the provided buffer. Therefore we already do
buffer[count] = 0;
This leads to an off-by-one buffer corruption as readlink() might return the full size of the buffer.
The common technique is to reduce the buffer size by one. Another fix would be to check
" if (count < 0 || count == sizeof(buffer)) fatal(); "
Reducing the buffer size by one is easier IMHO.
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Acked-by: David Rientjes <rientjes@google.com> Acked-by: Christoph Lameter <cl@gentwo.org> --- tools/slub/slabinfo.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/tools/slub/slabinfo.c b/tools/slub/slabinfo.c index 868cc93..cc1a378 100644 --- a/tools/slub/slabinfo.c +++ b/tools/slub/slabinfo.c @@ -1145,7 +1145,7 @@ static void read_slab_dir(void) switch (de->d_type) { case DT_LNK: alias->name = strdup(de->d_name); - count = readlink(de->d_name, buffer, sizeof(buffer)); + count = readlink(de->d_name, buffer, sizeof(buffer)-1); if (count < 0) fatal("Cannot read symlink %s\n", de->d_name); -- 1.7.6.4
| |