Re: [nfs-utils PATCH 1/2] junction: fix buffer over-read in junction_parse_xml_read()

[Steve Dickson <steved@redhat.com>]

On 9/3/26 1:53 PM, Scott Mayhew wrote:
> junction_get_xattr() returns an opaque buffer, but
> junction_parse_xml_read() treats it as a string by passing it to xlog().
> Fix it by allocating an extra byte and null-terminating the buffer in
> junction_get_xattr().
> 
> Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Committed... (tag: nfs-utils-2-9-3-rc4)

steved.
> ---
>   support/junction/junction.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/support/junction/junction.c b/support/junction/junction.c
> index c1ec8ff8..04a8ebf1 100644
> --- a/support/junction/junction.c
> +++ b/support/junction/junction.c
> @@ -293,7 +293,7 @@ junction_get_xattr(int fd, const char *path, const char *name, void **contents,
>   		return FEDFS_ERR_ACCESS;
>   	}
>   
> -	xattrbuf = malloc((size_t)len);
> +	xattrbuf = malloc((size_t)len + 1);
>   	if (xattrbuf == NULL) {
>   		xlog(D_GENERAL, "%s: failed to get buffer for xattr %s on %s",
>   			__func__, name, path);
> @@ -307,6 +307,7 @@ junction_get_xattr(int fd, const char *path, const char *name, void **contents,
>   		return FEDFS_ERR_ACCESS;
>   	}
>   
> +	((char *) xattrbuf)[len] = '\0';
>   	xlog(D_CALL, "%s: read xattr %s from path %s",
>   			__func__, name, path);
>   	*contents = xattrbuf;