mdmon: fix fd leak and possible buffer overrun.

We normally wouldn't close 'fd', and as 'buf' might not have
had a nul, strstr could have overrun it.

Signed-off-by: NeilBrown <neilb@suse.de>

diff --git a/mdmon.c b/mdmon.c
index 0ec42591500de9f6e5ca978fd1d5b20606009e2e..723c1a0147f4f222b7c81a346cb44ac947804181 100644 (file)
--- a/mdmon.c
+++ b/mdmon.c
@@ -180,6 +180,7 @@ static void try_kill_monitor(pid_t pid, char *devname, int sock)
        char buf[100];
        int fd;
        struct mdstat_ent *mdstat;
+       int n;
 
        /* first rule of survival... don't off yourself */
        if (pid == getpid())
@@ -191,12 +192,11 @@ static void try_kill_monitor(pid_t pid, char *devname, int sock)
        if (fd < 0)
                return;
 
-       if (read(fd, buf, sizeof(buf)) < 0) {
-               close(fd);
-               return;
-       }
+       n = read(fd, buf, sizeof(buf)-1);
+       buf[sizeof(buf)-1] = 0;
+       close(fd);
 
-       if (!strstr(buf, "mdmon"))
+       if (n < 0 || !strstr(buf, "mdmon"))
                return;
 
        kill(pid, SIGTERM);