lkml.org 
[lkml]   [1997]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subjectstill a bug in ext2/symlink.c (+patch)
First the docs:
DESCRIPTION
readlink places the contents of the symbolic link referred to by path in
the buffer buf, which has size bufsiz. The contents of the link are not
null-terminated when returned.
If the buffer passed to readlink is smaller than the symbolic link file
being read, readlink returns only as many characters as will fit in the
buffer.

Then what 2.1.22 does:
It will mistakenly write a terminating nul character.
It will fail to return the correct value when the contents just fits,
or is truncated.

A patch below.

Andries


--- symlink.c.orig Thu Jan 23 23:06:52 1997
+++ symlink.c Thu Jan 23 23:43:20 1997
@@ -122,12 +122,11 @@
}
else
link = (char *) inode->u.ext2_i.i_data;
-
- /* XXX I hope link is always '\0'-terminated. */
- i = strlen(link);
- if (i >= buflen)
- i = buflen-1;
- if (copy_to_user(buffer, link, i+1))
+
+ i = 0;
+ while (i < buflen && link[i])
+ i++;
+ if (copy_to_user(buffer, link, i))
i = -EFAULT;
if (DO_UPDATE_ATIME(inode)) {
inode->i_atime = CURRENT_TIME;
\
 
 \ /
  Last update: 2005-03-22 13:38    [W:0.039 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site