sysfs: avoid possible data corruption in sys_load.

[thirdparty/mdadm.git] / sysfs.c

diff --git a/sysfs.c b/sysfs.c
index 847a4e1e4caf8d8e38748397eafd664413eea9fa..8979ec4e23c80fd1812fe6b4f277cc4ad325d923 100644 (file)
--- a/sysfs.c
+++ b/sysfs.c
@@ -37,7 +37,7 @@ int load_sys(char *path, char *buf)
        if (n <0 || n >= 1024)
                return -1;
        buf[n] = 0;
        if (n <0 || n >= 1024)
                return -1;
        buf[n] = 0;

-       if (buf[n-1] == '\n')
+       if (n && buf[n-1] == '\n')

                buf[n-1] = 0;
        return 0;
 }
                buf[n-1] = 0;
        return 0;
 }


@@ -374,14 +374,16 @@ int sysfs_add_disk(struct mdinfo *sra, struct mdinfo *sd)
 
        memset(nm, 0, sizeof(nm));
        sprintf(dv, "/sys/dev/block/%d:%d", sd->disk.major, sd->disk.minor);
 
        memset(nm, 0, sizeof(nm));
        sprintf(dv, "/sys/dev/block/%d:%d", sd->disk.major, sd->disk.minor);

-       if (readlink(dv, nm, sizeof(nm)) < 0)
+       rv = readlink(dv, nm, sizeof(nm));
+       if (rv <= 0)

                return -1;
                return -1;

+       nm[rv] = '\0';

        dname = strrchr(nm, '/');
        if (dname) dname++;
        strcpy(sd->sys_name, "dev-");
        strcpy(sd->sys_name+4, dname);
 
        dname = strrchr(nm, '/');
        if (dname) dname++;
        strcpy(sd->sys_name, "dev-");
        strcpy(sd->sys_name+4, dname);
 

-       rv |= sysfs_set_num(sra, sd, "offset", sd->data_offset);
+       rv = sysfs_set_num(sra, sd, "offset", sd->data_offset);

        rv |= sysfs_set_num(sra, sd, "size", (sd->component_size+1) / 2);
        if (sra->array.level != LEVEL_CONTAINER) {
                rv |= sysfs_set_num(sra, sd, "slot", sd->disk.raid_disk);
        rv |= sysfs_set_num(sra, sd, "size", (sd->component_size+1) / 2);
        if (sra->array.level != LEVEL_CONTAINER) {
                rv |= sysfs_set_num(sra, sd, "slot", sd->disk.raid_disk);