Commit fe353178 authored Oct 17, 2011 by Thomas Jarosch Committed by Pekka Enberg Oct 18, 2011

tools, slub: Fix off-by-one buffer corruption after readlink() call



readlink() never zero terminates the provided buffer.
Therefore we already do

    buffer[count] = 0;

This leads to an off-by-one buffer corruption as readlink()
might return the full size of the buffer.

The common technique is to reduce the buffer size by one.
Another fix would be to check

  if (count < 0 || count == sizeof(buffer))
      fatal();

Reducing the buffer size by one is easier IMHO.

Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Acked-by: David Rientjes <rientjes@google.com>
Acked-by: Christoph Lameter <cl@gentwo.org>
Signed-off-by: Pekka Enberg <penberg@kernel.org>

parent ab067e99

tools/slub/slabinfo.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1145,7 +1145,7 @@ static void read_slab_dir(void)
		switch (de->d_type) {
		case DT_LNK:
		alias->name = strdup(de->d_name);
		count = readlink(de->d_name, buffer, sizeof(buffer));
		count = readlink(de->d_name, buffer, sizeof(buffer)-1);

		if (count < 0)
		fatal("Cannot read symlink %s\n", de->d_name);

Admin message