From d77f7779b4d74354b3444ceb0f93105ced3c26c8 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Fri, 21 Feb 2014 17:43:09 +0100 Subject: fsdev: Fix overrun after readlink() fills buffer completely readlink() returns the number of bytes written to the buffer, and it doesn't write a terminating null byte. do_readlink() writes it itself. Overruns the buffer when readlink() filled it completely. Fix by reserving space for the null byte when calling readlink(), like we do elsewhere. Signed-off-by: Markus Armbruster Signed-off-by: Aneesh Kumar K.V --- fsdev/virtfs-proxy-helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'fsdev') diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c index 713a7b2b87..bfecb8706c 100644 --- a/fsdev/virtfs-proxy-helper.c +++ b/fsdev/virtfs-proxy-helper.c @@ -595,7 +595,7 @@ static int do_readlink(struct iovec *iovec, struct iovec *out_iovec) } buffer = g_malloc(size); v9fs_string_init(&target); - retval = readlink(path.data, buffer, size); + retval = readlink(path.data, buffer, size - 1); if (retval > 0) { buffer[retval] = '\0'; v9fs_string_sprintf(&target, "%s", buffer); -- cgit v1.2.3