lkml.org 
[lkml]   [2011]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[slabinfo PATCH v2] Fix off-by-one buffer corruption after readlink() call
Date
readlink() never zero terminates the provided buffer.
Therefore we already do

buffer[count] = 0;

This leads to an off-by-one buffer corruption as readlink()
might return the full size of the buffer.

The common technique is to reduce the buffer size by one.
Another fix would be to check

"
if (count < 0 || count == sizeof(buffer))
fatal();
"

Reducing the buffer size by one is easier IMHO.

Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Acked-by: David Rientjes <rientjes@google.com>
Acked-by: Christoph Lameter <cl@gentwo.org>
---
tools/slub/slabinfo.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/tools/slub/slabinfo.c b/tools/slub/slabinfo.c
index 868cc93..cc1a378 100644
--- a/tools/slub/slabinfo.c
+++ b/tools/slub/slabinfo.c
@@ -1145,7 +1145,7 @@ static void read_slab_dir(void)
switch (de->d_type) {
case DT_LNK:
alias->name = strdup(de->d_name);
- count = readlink(de->d_name, buffer, sizeof(buffer));
+ count = readlink(de->d_name, buffer, sizeof(buffer)-1);

if (count < 0)
fatal("Cannot read symlink %s\n", de->d_name);
--
1.7.6.4

\
 
 \ /
  Last update: 2011-10-17 16:51    [W:7.945 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site