On Fri, 2011-10-21 at 23:05 +0200, Thomas Jarosch wrote:
> readlink() never terminates the buffer.
>
> Detected by "cppcheck" (git HEAD)
Not that it's a terrible idea to make it more obvious, but these
weren't bugs...
> Signed-off-by: Thomas Jarosch <thomas.jarosch@xxxxxxxxxxxxx>
> ---
> lib/rpmfi.c | 8 ++++++--
> 1 files changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/lib/rpmfi.c b/lib/rpmfi.c
> index e1e8fa9..6186d9f 100644
> --- a/lib/rpmfi.c
> +++ b/lib/rpmfi.c
[...]
memset(buffer, 0, sizeof(buffer));
if (dbWhat == REG) {
[...]
} else /* dbWhat == LINK */ {
const char * oFLink, * nFLink;
oFLink = rpmfiFLink(ofi);
if (diskWhat == LINK) {
if (readlink(fn, buffer, sizeof(buffer) - 1) == -1)
...so "buffer[sizeof(buffer) -1] == 0" already.
> @@ -661,8 +661,10 @@ rpmFileAction rpmfiDecideFate(const rpmfi ofi, rpmfi nfi, int skipMissing)
> const char * oFLink, * nFLink;
> oFLink = rpmfiFLink(ofi);
> if (diskWhat == LINK) {
> - if (readlink(fn, buffer, sizeof(buffer) - 1) == -1)
> + ssize_t link_len = readlink(fn, buffer, sizeof(buffer) - 1);
> + if (link_len == -1)
> return FA_CREATE; /* assume file has been removed */
> + buffer[link_len] = '\0';
> if (oFLink && rstreq(oFLink, buffer))
> return FA_CREATE; /* unmodified config file, replace. */
> }
> @@ -712,8 +714,10 @@ int rpmfiConfigConflict(const rpmfi fi)
> return 0; /* unmodified config file */
> } else /* newWhat == LINK */ {
> const char * nFLink;
> - if (readlink(fn, buffer, sizeof(buffer) - 1) == -1)
> + ssize_t link_len = readlink(fn, buffer, sizeof(buffer) - 1);
> + if (link_len == -1)
> return 0; /* assume file has been removed */
> + buffer[link_len] = '\0';
> nFLink = rpmfiFLink(fi);
> if (nFLink && rstreq(nFLink, buffer))
> return 0; /* unmodified config file */
Same memset() is just off the patch here too.
_______________________________________________
Rpm-list mailing list
Rpm-list@xxxxxxxxxxxxx
http://lists.rpm.org/mailman/listinfo/rpm-list
