[PATCH] remove buffer-overrun risk in readlink call

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



readlink does not write a nul character to the end of the
string it returns. Therefore ask for one fewer character
than the buffer size so there's always room for an extra \0.

Signed-off-by: Mathias Nyman <mathias.nyman@xxxxxxxxx>
Signed-off-by: Phil Carmody <ext-phil.2.carmody@xxxxxxxxx>
---
 udev/udev-node.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/udev/udev-node.c b/udev/udev-node.c
index 2a2c2cf..ceb1d52 100644
--- a/udev/udev-node.c
+++ b/udev/udev-node.c
@@ -163,7 +163,7 @@ static int node_symlink(struct udev *udev, const char *node, const char *slink)
 			int len;
 
 			dbg(udev, "found existing symlink '%s'\n", slink);
-			len = readlink(slink, buf, sizeof(buf));
+			len = readlink(slink, buf, sizeof(buf) - 1);
 			if (len > 0) {
 				buf[len] = '\0';
 				if (strcmp(target, buf) == 0) {
-- 
1.5.6.5

--
To unsubscribe from this list: send the line "unsubscribe linux-hotplug" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Kernel]     [Linux DVB]     [Asterisk Internet PBX]     [DCCP]     [Netdev]     [X.org]     [Util Linux NG]     [Fedora Women]     [ALSA Devel]     [Linux USB]

  Powered by Linux