lib/server/cf_file: off-by-one heap write in ${/path} expansion when st_size under...

diff --git a/src/lib/server/cf_file.c b/src/lib/server/cf_file.c
index 8d6615627cb0552213a21d3da823a47d1235c673..0c7525ece9d69bd8607bb6481ee5579cb6fc7a9a 100644 (file)
--- a/src/lib/server/cf_file.c
+++ b/src/lib/server/cf_file.c
@@ -403,7 +403,7 @@ char const *cf_expand_variables(char const *cf, int lineno,
                                        return NULL;
                                }
 
-                               len = read(fd, p, (output + outsize) - p);
+                               len = read(fd, p, (output + outsize) - p - 1);
                                if (len < 0) goto fail_fd;
 
                                close(fd);
@@ -774,7 +774,7 @@ static int cf_file_open(CONF_SECTION *cs, char const *filename, bool from_dir, F
 
        if (DEBUG_ENABLED2) cf_log_debug(cs, "including configuration file %s", filename);
 
-       if (!fp) {              
+       if (!fp) {
        error:
                ERROR("Unable to open file \"%s\": %s", filename, fr_syserror(errno));
                return -1;