All of lore.kernel.org
 help / color / mirror / Atom feed
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
To: akpm@linux-foundation.org
Cc: linux-mm@kvack.org, Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Subject: [PATCH v2] tools/mm/slabinfo: fix access to null terminator in string boundary
Date: Sat, 30 Aug 2025 22:50:22 +0530	[thread overview]
Message-ID: <20250830172022.1927448-1-kaushlendra.kumar@intel.com> (raw)

The current code incorrectly accesses buffer[strlen(buffer)], which
points to the null terminator ('\0') at the end of the string. This is
technically out-of-bounds access since valid string content ends at
index strlen(buffer)-1.

Fix by:
1. Declaring strlen() result variable at function scope
2. Adding bounds check (len > 0) to handle empty strings
3. Using buffer[len-1] to correctly access the last character before
   the null terminator

v2: Move variable declaration to function scope to avoid mixing
    declarations with statements (feedback from reviewer)

Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
---
 tools/mm/slabinfo.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/mm/slabinfo.c b/tools/mm/slabinfo.c
index 1433eff99feb..d2e5b4e232b1 100644
--- a/tools/mm/slabinfo.c
+++ b/tools/mm/slabinfo.c
@@ -155,6 +155,8 @@ static void usage(void)
 
 static unsigned long read_obj(const char *name)
 {
+	size_t len;
+
 	FILE *f = fopen(name, "r");
 
 	if (!f) {
@@ -165,8 +167,10 @@ static unsigned long read_obj(const char *name)
 		if (!fgets(buffer, sizeof(buffer), f))
 			buffer[0] = 0;
 		fclose(f);
-		if (buffer[strlen(buffer)] == '\n')
-			buffer[strlen(buffer)] = 0;
+		len = strlen(buffer);
+
+		if (len > 0 && buffer[len - 1] == '\n')
+			buffer[len - 1] = 0;
 	}
 	return strlen(buffer);
 }
-- 
2.34.1



             reply	other threads:[~2025-08-30 17:21 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-08-30 17:20 Kaushlendra Kumar [this message]
2025-09-01  3:23 ` [PATCH v2] tools/mm/slabinfo: fix access to null terminator in string boundary SeongJae Park
2025-09-01  4:57   ` Kumar, Kaushlendra
2025-09-01  5:43   ` Kumar, Kaushlendra

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250830172022.1927448-1-kaushlendra.kumar@intel.com \
    --to=kaushlendra.kumar@intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=linux-mm@kvack.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.