diff --git a/vfs/ChangeLog b/vfs/ChangeLog index 7ad926fce..d24429c26 100644 --- a/vfs/ChangeLog +++ b/vfs/ChangeLog @@ -1,5 +1,7 @@ 2002-08-19 Pavel Roskin + * direntry.c (vfs_s_get_line): Fix off-by-one buffer overflow. + * fish.c (pipeopen): Use _exit(), not vfs_die() to terminate the child if execvp() fails. diff --git a/vfs/direntry.c b/vfs/direntry.c index 158b01f7a..32e905c53 100644 --- a/vfs/direntry.c +++ b/vfs/direntry.c @@ -1134,7 +1134,7 @@ vfs_s_get_line (vfs *me, int sock, char *buf, int buf_len, char term) int i, status; char c; - for (i = 0; i < buf_len; i++, buf++){ + for (i = 0; i < buf_len - 1; i++, buf++){ if (read (sock, buf, sizeof(char)) <= 0) return 0; if (logfile){ @@ -1146,6 +1146,8 @@ vfs_s_get_line (vfs *me, int sock, char *buf, int buf_len, char term) return 1; } } + + /* Line is too long - terminate buffer and discard the rest of line */ *buf = 0; while ((status = read (sock, &c, sizeof (c))) > 0){ if (logfile){