From: Alexander Bainbridge-Sedivy <alex.bainbridge@inkbridge.io>
Date: Wed, 24 Jun 2026 19:37:59 +0000 (-0400)
Subject: lib/server/cf_file: off-by-one heap write in ${/path} expansion when st_size under... 
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=73958de431fc7bb3efc4588248be62dfc5bf02bd;p=thirdparty%2Ffreeradius-server.git

lib/server/cf_file: off-by-one heap write in ${/path} expansion when st_size under-reports readable bytes (procfs/devices/pipes)
---

diff --git a/src/lib/server/cf_file.c b/src/lib/server/cf_file.c
index 8d6615627cb..0c7525ece9d 100644
--- a/src/lib/server/cf_file.c
+++ b/src/lib/server/cf_file.c
@@ -403,7 +403,7 @@ char const *cf_expand_variables(char const *cf, int lineno,
 					return NULL;
 				}
 
-				len = read(fd, p, (output + outsize) - p);
+				len = read(fd, p, (output + outsize) - p - 1);
 				if (len < 0) goto fail_fd;
 
 				close(fd);
@@ -774,7 +774,7 @@ static int cf_file_open(CONF_SECTION *cs, char const *filename, bool from_dir, F
 
 	if (DEBUG_ENABLED2) cf_log_debug(cs, "including configuration file %s", filename);
 
-	if (!fp) {		
+	if (!fp) {
 	error:
 		ERROR("Unable to open file \"%s\": %s", filename, fr_syserror(errno));
 		return -1;