lkml.org 
[lkml]   [2011]   [Oct]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [slabinfo PATCH] Fix off-by-one after readlink() call
    On 10/14/2011 07:16 PM, Christoph Lameter wrote:
    >> index 868cc93..cc1a378 100644
    >> --- a/tools/slub/slabinfo.c
    >> +++ b/tools/slub/slabinfo.c
    >> @@ -1145,7 +1145,7 @@ static void read_slab_dir(void)
    >> switch (de->d_type) {
    >> case DT_LNK:
    >> alias->name = strdup(de->d_name);
    >> - count = readlink(de->d_name, buffer, sizeof(buffer));
    >> + count = readlink(de->d_name, buffer, sizeof(buffer)-1);
    >>
    >
    > DESCRIPTION
    > readlink() places the contents of the symbolic link path in the buffer buf, which has size bufsiz. readlink() does not append a
    > null byte to buf. It will truncate the contents (to a length of bufsiz characters), in case the buffer is too small to hold all of
    > the contents.

    The problem is the line after the readlink() call:

    buffer[count] = '\0';

    The common technique is to reduce the buffer size by one.
    Another fix would be to check

    "
    if (count < 0 || count == sizeof(buffer))
    fatal();
    "

    Reducing the buffer size by one is easier IMHO.

    Cheers,
    Thomas


    \
     
     \ /
      Last update: 2011-10-14 19:29    [W:0.024 / U:33.192 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site