commit d77f7779b4d74354b3444ceb0f93105ced3c26c8
author Markus Armbruster <armbru@redhat.com> Fri Feb 21 17:43:09 2014 +0100
committer Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Wed Feb 26 12:24:07 2014 +0530
tree 29588786a2274c0b4a3099eead1b6c5f5942c351
parent d5001cf787ad0514839a81d0f2e771e01e076e21

fsdev: Fix overrun after readlink() fills buffer completely

readlink() returns the number of bytes written to the buffer, and it
doesn't write a terminating null byte.  do_readlink() writes it
itself.  Overruns the buffer when readlink() filled it completely.

Fix by reserving space for the null byte when calling readlink(), like
we do elsewhere.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

fsdev/virtfs-proxy-helper.c

diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
index 713a7b2..bfecb87 100644
--- a/fsdev/virtfs-proxy-helper.c
+++ b/fsdev/virtfs-proxy-helper.c
@@ -595,7 +595,7 @@
     }
     buffer = g_malloc(size);
     v9fs_string_init(&target);
-    retval = readlink(path.data, buffer, size);
+    retval = readlink(path.data, buffer, size - 1);
     if (retval > 0) {
         buffer[retval] = '\0';
         v9fs_string_sprintf(&target, "%s", buffer);