@@ -1276,12 +1276,12 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
}
/* copy extension buffer into buffer */
- strncpy(buffer, st->extension, buflen);
+ retval = min(strlen(st->extension)+1, (size_t)buflen);
+ memcpy(buffer, st->extension, retval);
- p9_debug(P9_DEBUG_VFS, "%s -> %s (%s)\n",
- dentry->d_name.name, st->extension, buffer);
+ p9_debug(P9_DEBUG_VFS, "%s -> %s (%.*s)\n",
+ dentry->d_name.name, st->extension, buflen, buffer);
- retval = strnlen(buffer, buflen);
done:
p9stat_free(st);
kfree(st);
Reading a symlink longer than the given buffer, a p9_debug use would try to print the link name (not NUL-terminated) using a %s format. Use %.*s instead, and replace the strncpy+strnlen with functionally equivalent strlen+memcpy. Signed-off-by: Jim Meyering <meyering@redhat.com> --- V1 provoked a warning due to strlen/buflen type differences (size_t/int) and the "min" macro's type equality requirement. This adds a cast to avoid that warning: - retval = min(strlen(st->extension)+1, buflen); + retval = min(strlen(st->extension)+1, (size_t)buflen); fs/9p/vfs_inode.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 1.7.12 ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/