Append null byte when readlink on backend path 81/108581/2
authorSangyoon Jang <s89.jang@samsung.com>
Thu, 5 Jan 2017 06:34:24 +0000 (15:34 +0900)
committerSangyoon Jang <s89.jang@samsung.com>
Thu, 5 Jan 2017 06:36:27 +0000 (15:36 +0900)
readlink() does not append a null byte to buf.

Change-Id: I28034db705afd0ad1b1a5275f7896a6f9f0c3399
Signed-off-by: Sangyoon Jang <s89.jang@samsung.com>
src/queue.c

index 68b0476..13617ab 100644 (file)
@@ -121,6 +121,7 @@ int _push_queue(uid_t target_uid, uid_t caller_uid, const char *req_id,
 static int __init_backends(const char *fpath, const struct stat *sb,
                int typeflag, struct FTW *ftwbuf)
 {
+       int r;
        struct backend_queue *queue;
 
        if (typeflag != FTW_F && typeflag != FTW_SL)
@@ -131,12 +132,14 @@ static int __init_backends(const char *fpath, const struct stat *sb,
                queue->path = strdup(fpath);
        } else if (typeflag == FTW_SL) {
                queue->path = malloc(sb->st_size + 1);
-               if (readlink(fpath, queue->path, sb->st_size + 1) < 0) {
+               r = readlink(fpath, queue->path, sb->st_size + 1);
+               if (r < 0 || r > sb->st_size) {
                        ERR("failed to readlink for %s", fpath);
                        free(queue->path);
                        free(queue);
                        return -1;
                }
+               queue->path[r] = '\0';
        }
        queue->type = strdup(fpath + ftwbuf->base);
        queue->slot = num_of_backends++;