readlink does not NUL-terminate the output buffer. This led to spurious
failures to destroy the md device because the unit number was garbage.
NUL-terminate the output buffer.
Reported by: ASLR
MFC after: 1 week
Sponsored by: Dell EMC Isilon
(cherry picked from commit
ea0e1b19f232331bffa75a0a64a6859c40f1cc4d)
strerror(errno));
return;
}
- n = readlink(MDUNIT_LINK, buf, sizeof(buf));
+ n = readlink(MDUNIT_LINK, buf, sizeof(buf) - 1);
if (n > 0) {
+ buf[n] = '\0';
if (sscanf(buf, "%d", &unit) == 1 && unit >= 0) {
bzero(&mdio, sizeof(mdio));
mdio.md_version = MDIOVERSION;