Fix buffer termination off-by-1 in link comparison code

diff --git a/ChangeLog b/ChangeLog
index 7fb53b9f093f5d3506aa289f7ddc297421f6d45f..11fc36cf816b084873d1a0f3312e2ea3411b96d1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Sat Dec  1 10:22:34 EST 2007 Daniel P. Berrange <berrange@redhat.com>
+
+       * src/qemu_driver.c: Fix off-by-1 buffer NULL termination in
+       symlink comparison code
+
 Fri Nov 30 17:50:34 EST 2007 Daniel P. Berrange <berrange@redhat.com>
 
        * src/xml.c, src/xml.h: Disable xen specific functions if

diff --git a/src/qemu_conf.c b/src/qemu_conf.c
index a3aaaf3811999b763d792272146aaf5fcb31d689..12741b481f14237b862f4feb9c193ab50b786bb7 100644 (file)
--- a/src/qemu_conf.c
+++ b/src/qemu_conf.c
@@ -2667,7 +2667,7 @@ checkLinkPointsTo(const char *checkLink,
         char *p;
 
         strncpy(dir, checkLink, PATH_MAX);
-        dir[PATH_MAX] = '\0';
+        dir[PATH_MAX-1] = '\0';
 
         if (!(p = strrchr(dir, '/'))) {
             qemudLog(QEMUD_WARN, "Symlink path '%s' is not absolute", checkLink);
@@ -2685,7 +2685,7 @@ checkLinkPointsTo(const char *checkLink,
         }
 
         strncpy(dest, tmp, PATH_MAX);
-        dest[PATH_MAX] = '\0';
+        dest[PATH_MAX-1] = '\0';
     }
 
     /* canonicalize both paths */
@@ -2693,14 +2693,14 @@ checkLinkPointsTo(const char *checkLink,
         qemudLog(QEMUD_WARN, "Failed to expand path '%s' :%s",
                  dest, strerror(errno));
         strncpy(real, dest, PATH_MAX);
-        real[PATH_MAX] = '\0';
+        real[PATH_MAX-1] = '\0';
     }
 
     if (!realpath(checkDest, checkReal)) {
         qemudLog(QEMUD_WARN, "Failed to expand path '%s' :%s",
                  checkDest, strerror(errno));
         strncpy(checkReal, checkDest, PATH_MAX);
-        checkReal[PATH_MAX] = '\0';
+        checkReal[PATH_MAX-1] = '\0';
     }
 
     /* compare */