提交 fe353178 编写于 作者: T Thomas Jarosch 提交者: Pekka Enberg

tools, slub: Fix off-by-one buffer corruption after readlink() call

readlink() never zero terminates the provided buffer.
Therefore we already do

    buffer[count] = 0;

This leads to an off-by-one buffer corruption as readlink()
might return the full size of the buffer.

The common technique is to reduce the buffer size by one.
Another fix would be to check

  if (count < 0 || count == sizeof(buffer))
      fatal();

Reducing the buffer size by one is easier IMHO.
Signed-off-by: NThomas Jarosch <thomas.jarosch@intra2net.com>
Acked-by: NDavid Rientjes <rientjes@google.com>
Acked-by: NChristoph Lameter <cl@gentwo.org>
Signed-off-by: NPekka Enberg <penberg@kernel.org>
上级 ab067e99
无相关合并请求
......@@ -1145,7 +1145,7 @@ static void read_slab_dir(void)
switch (de->d_type) {
case DT_LNK:
alias->name = strdup(de->d_name);
count = readlink(de->d_name, buffer, sizeof(buffer));
count = readlink(de->d_name, buffer, sizeof(buffer)-1);
if (count < 0)
fatal("Cannot read symlink %s\n", de->d_name);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册
新手
引导
客服 返回
顶部