Fix off-by-one in readlink() buffer size handling

readlink() returns the number of bytes in the buffer.

If we do something like

len = readlink(path, buf, sizeof(buf));
buf[len] = '\0';

we might write one byte past the end of the buffer.

Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: NeilBrown <neilb@suse.de>

diff --git a/policy.c b/policy.c
index ef4835372d1427932e5ee4022e9f37358af652b5..7959c97042c8f168295a59efab064c5a66090cb7 100644 (file)
--- a/policy.c
+++ b/policy.c
@@ -222,7 +222,7 @@ static char *disk_path(struct mdinfo *disk)
        closedir(by_path);
        /* A NULL path isn't really acceptable - use the devname.. */
        sprintf(symlink, "/sys/dev/block/%d:%d", disk->disk.major, disk->disk.minor);
-       rv = readlink(symlink, nm, sizeof(nm));
+       rv = readlink(symlink, nm, sizeof(nm)-1);
        if (rv > 0) {
                char *dname;
                nm[rv] = 0;

diff --git a/super-intel.c b/super-intel.c
index af06660bd6e906daf1f7edf8bc369760fd897f73..401c701f20f1bc617f038a965880ce9b21b4ac10 100644 (file)
--- a/super-intel.c
+++ b/super-intel.c
@@ -2864,7 +2864,7 @@ static void fd2devname(int fd, char *name)
        sprintf(path, "/sys/dev/block/%d:%d",
                major(st.st_rdev), minor(st.st_rdev));
 
-       rv = readlink(path, dname, sizeof(dname));
+       rv = readlink(path, dname, sizeof(dname)-1);
        if (rv <= 0)
                return;
        

diff --git a/sysfs.c b/sysfs.c
index e1aaf4d9457804ecd7f7aab1f71bbf68d7235d91..a5fcdd0388ced1f7b9898a9409c8a0246df4013d 100644 (file)
--- a/sysfs.c
+++ b/sysfs.c
@@ -619,7 +619,7 @@ int sysfs_add_disk(struct mdinfo *sra, struct mdinfo *sd, int resume)
 
        memset(nm, 0, sizeof(nm));
        sprintf(dv, "/sys/dev/block/%d:%d", sd->disk.major, sd->disk.minor);
-       rv = readlink(dv, nm, sizeof(nm));
+       rv = readlink(dv, nm, sizeof(nm)-1);
        if (rv <= 0)
                return -1;
        nm[rv] = '\0';

diff --git a/util.c b/util.c
index 50c98c1cabac335052132f4d411846647258a1d6..f785f0305301019756e8184c213c6e7d0c03b208 100644 (file)
--- a/util.c
+++ b/util.c
@@ -1594,7 +1594,7 @@ int start_mdmon(int devnum)
        if (check_env("MDADM_NO_MDMON"))
                return 0;
 
-       len = readlink("/proc/self/exe", pathbuf, sizeof(pathbuf));
+       len = readlink("/proc/self/exe", pathbuf, sizeof(pathbuf)-1);
        if (len > 0) {
                char *sl;
                pathbuf[len] = 0;