From 3d41e4d8389578e5d5f3cf2e47b9ff9cdd29ffd1 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Wed, 2 Apr 2025 15:43:40 +1100 Subject: passt-repair: Correct off-by-one error verifying name passt-repair will generate an error if the name it gets from the kernel is too long or not NUL terminated. Downstream testing has reported occasionally seeing this error in practice. In turns out there is a trivial off-by-one error in the check: ev->len is the length of the name, including terminating \0 characters, so to check for a \0 at the end of the buffer we need to check ev->name[len - 1] not ev->name[len]. Fixes: 42a854a52b6f ("pasta, passt-repair: Support multiple events per read() in inotify handlers") Signed-off-by: David Gibson Signed-off-by: Stefano Brivio --- passt-repair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/passt-repair.c b/passt-repair.c index 86f0293..440c77a 100644 --- a/passt-repair.c +++ b/passt-repair.c @@ -157,7 +157,7 @@ int main(int argc, char **argv) } } while (!found); - if (ev->len > NAME_MAX + 1 || ev->name[ev->len] != '\0') { + if (ev->len > NAME_MAX + 1 || ev->name[ev->len - 1] != '\0') { fprintf(stderr, "Invalid filename from inotify\n"); _exit(1); } -- cgit v1.2.3