From fe353178653b15add8626f5474842601be160281 Mon Sep 17 00:00:00 2001 From: Thomas Jarosch Date: Mon, 17 Oct 2011 16:48:10 +0200 Subject: [PATCH] tools, slub: Fix off-by-one buffer corruption after readlink() call readlink() never zero terminates the provided buffer. Therefore we already do buffer[count] = 0; This leads to an off-by-one buffer corruption as readlink() might return the full size of the buffer. The common technique is to reduce the buffer size by one. Another fix would be to check if (count < 0 || count == sizeof(buffer)) fatal(); Reducing the buffer size by one is easier IMHO. Signed-off-by: Thomas Jarosch Acked-by: David Rientjes Acked-by: Christoph Lameter Signed-off-by: Pekka Enberg --- tools/slub/slabinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/slub/slabinfo.c b/tools/slub/slabinfo.c index 868cc93f7ac2..cc1a378f9c06 100644 --- a/tools/slub/slabinfo.c +++ b/tools/slub/slabinfo.c @@ -1145,7 +1145,7 @@ static void read_slab_dir(void) switch (de->d_type) { case DT_LNK: alias->name = strdup(de->d_name); - count = readlink(de->d_name, buffer, sizeof(buffer)); + count = readlink(de->d_name, buffer, sizeof(buffer)-1); if (count < 0) fatal("Cannot read symlink %s\n", de->d_name);