tools, slub: Fix off-by-one buffer corruption after readlink() call
readlink() never zero terminates the provided buffer.
Therefore we already do
    buffer[count] = 0;
This leads to an off-by-one buffer corruption as readlink()
might return the full size of the buffer.
The common technique is to reduce the buffer size by one.
Another fix would be to check
  if (count < 0 || count == sizeof(buffer))
      fatal();
Reducing the buffer size by one is easier IMHO.
Signed-off-by:  Thomas Jarosch <thomas.jarosch@intra2net.com>
Acked-by:
Thomas Jarosch <thomas.jarosch@intra2net.com>
Acked-by:  David Rientjes <rientjes@google.com>
Acked-by:
David Rientjes <rientjes@google.com>
Acked-by:  Christoph Lameter <cl@gentwo.org>
Signed-off-by:
Christoph Lameter <cl@gentwo.org>
Signed-off-by:  Pekka Enberg <penberg@kernel.org>
Pekka Enberg <penberg@kernel.org>
Loading
Please register or sign in to comment
