Correctly NUL-terminate link name in sprof

diff --git a/ChangeLog b/ChangeLog
index d5d7cb5c74fbd45e1e70e31843a350ddb3192fb0..6cb54e65d498afef23d846a9a3155de6f7a2ab84 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2011-10-29  Ulrich Drepper  <drepper@gmail.com>
 
+       [BZ #13337]
+       * elf/sprof.c (load_shobj): Correctly NUL-terminate link name.
+       Patch by Thomas Jarosch <thomas.jarosch@intra2net.com>.
+
        * elf/chroot_canon.c (chroot_canon): Cleanups.
 
        * elf/dl-lookup.c (_dl_setup_hash): Avoid warning.

diff --git a/NEWS b/NEWS
index c9952a896e011fcda269436e8e28698a51f9a851..e4b9f449d33ad5db8f930cee50cc59d266a3a414 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,7 +12,7 @@ Version 2.15
   6779, 6783, 9696, 11589, 12403, 12847, 12868, 12852, 12874, 12885, 12892,
   12907, 12922, 12935, 13007, 13021, 13067, 13068, 13090, 13092, 13114,
   13118, 13123, 13134, 13138, 13150, 13179, 13192, 13268, 13291, 13335,
-  13344
+  13337, 13344
 
 * New program pldd to list loaded object of a process
   Implemented by Ulrich Drepper.

diff --git a/elf/sprof.c b/elf/sprof.c
index dbe217b083e07dd7c2236ada759fd243455011b1..069649a654c4d3586684a8557862853dff5dddd1 100644 (file)
--- a/elf/sprof.c
+++ b/elf/sprof.c
@@ -596,10 +596,11 @@ load_shobj (const char *name)
       static const char procpath[] = "/proc/self/fd/%d";
       char origprocname[sizeof (procpath) + sizeof (int) * 3];
       snprintf (origprocname, sizeof (origprocname), procpath, fd);
-      char *origlink = (char *) alloca (PATH_MAX + 1);
-      origlink[PATH_MAX] = '\0';
-      if (readlink (origprocname, origlink, PATH_MAX) == -1)
+      char *origlink = (char *) alloca (PATH_MAX);
+      ssize_t n = readlink (origprocname, origlink, PATH_MAX)
+      if (n == -1)
        goto no_debuginfo;
+      origlink[n] = '\0';
 
       /* Try to find the actual file.  There are three places:
         1. the same directory the DSO is in