[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/5] fsdev: Fix overrun after readlink() fills buffe
From: |
Aneesh Kumar K.V |
Subject: |
[Qemu-devel] [PATCH 1/5] fsdev: Fix overrun after readlink() fills buffer completely |
Date: |
Fri, 7 Mar 2014 20:46:16 +0530 |
From: Markus Armbruster <address@hidden>
readlink() returns the number of bytes written to the buffer, and it
doesn't write a terminating null byte. do_readlink() writes it
itself. Overruns the buffer when readlink() filled it completely.
Fix by reserving space for the null byte when calling readlink(), like
we do elsewhere.
Signed-off-by: Markus Armbruster <address@hidden>
Signed-off-by: Aneesh Kumar K.V <address@hidden>
---
fsdev/virtfs-proxy-helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
index 713a7b2b87a4..bfecb8706c85 100644
--- a/fsdev/virtfs-proxy-helper.c
+++ b/fsdev/virtfs-proxy-helper.c
@@ -595,7 +595,7 @@ static int do_readlink(struct iovec *iovec, struct iovec
*out_iovec)
}
buffer = g_malloc(size);
v9fs_string_init(&target);
- retval = readlink(path.data, buffer, size);
+ retval = readlink(path.data, buffer, size - 1);
if (retval > 0) {
buffer[retval] = '\0';
v9fs_string_sprintf(&target, "%s", buffer);
--
1.8.3.2
[Qemu-devel] [PATCH 3/5] hw/9pfs/virtio-9p-local.c: use snprintf() instead of sprintf(), Aneesh Kumar K.V, 2014/03/07