Fix unterminated buffer after readlink() call

Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: NeilBrown <neilb@suse.de>

diff --git a/mdopen.c b/mdopen.c
index 0a174211512d5d16c98f43e80c2eb2a821f086a8..555ab84f6d4de832cdbf3b2d0355887ddd196288 100644 (file)
--- a/mdopen.c
+++ b/mdopen.c
@@ -360,8 +360,12 @@ int create_mddev(char *dev, char *name, int autof, int trustworthy,
 
                        if (lstat(chosen, &stb) == 0) {
                                char buf[300];
+                               ssize_t link_len = readlink(chosen, buf, sizeof(buf)-1);
+                               if (link_len >= 0)
+                                       buf[link_len] = '\0';
+
                                if ((stb.st_mode & S_IFMT) != S_IFLNK ||
-                                   readlink(chosen, buf, 300) <0 ||
+                                   link_len < 0 ||
                                    strcmp(buf, devname) != 0) {
                                        fprintf(stderr, Name ": %s exists - ignoring\n",
                                                chosen);