2002-11-27 Chip Salzenberg <chip@pobox.com>

	* utils/mountd/rmtab.c (slink_safe_rename): Fix off-by-one buffer
	overflow bug.  Reformat per rest of source file.

diff --git a/ChangeLog b/ChangeLog
index ee7d4d504ef3f47efe95f31a6e08e18e57b93688..9fae2b24918700458487efdfcccd015f555bf1e7 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2002-11-27  Chip Salzenberg  <chip@pobox.com>
+
+       * utils/mountd/rmtab.c (slink_safe_rename): Fix off-by-one buffer
+       overflow bug.  Reformat per rest of source file.
+
 2002-11-19  NeilBrown <neilb@cse.unsw.edu.au>
 
        * utils/exportfs/exports.man: Correct notes about whether the wild

diff --git a/utils/mountd/rmtab.c b/utils/mountd/rmtab.c
index 0a4ed4c6b1b09269978c0462a0f67354f163b756..869b5f88fd791881eee6d01951cdfe1185222b9d 100644 (file)
--- a/utils/mountd/rmtab.c
+++ b/utils/mountd/rmtab.c
@@ -29,30 +29,21 @@
 static int 
 slink_safe_rename(const char * oldpath, const char * newpath)
 {
-  int r;
-  struct stat s;
-  char slink_path[PATH_MAX];
-  char real_newpath = newpath;
-
-  if((lstat(newpath, &s) == 0) && (S_ISLNK(s.st_mode))) {
-
-    /* New path is a symbolic link, do not destroy but follow */
-
-    if((r = readlink(newpath, slink_path, PATH_MAX))==-1) {
-
-      return -1;
-
-    }
-
-    slink_path[ (r < PATH_MAX) ? (r + 1) : (PATH_MAX - 1)] = '\0';
-
-    real_newpath = slink_path;
-
-  }
-
-  return rename(oldpath, real_newpath);
+       int r;
+       struct stat s;
+       char slink_path[PATH_MAX];
+       char real_newpath = newpath;
+
+       if ((lstat(newpath, &s) == 0) && S_ISLNK(s.st_mode)) {
+               /* New path is a symbolic link, do not destroy but follow */
+               if ((r = readlink(newpath, slink_path, PATH_MAX - 1)) == -1)
+                       return -1;
+               slink_path[r] = '\0';
+               real_newpath = slink_path;
+       }
 
-}/* static int slink_safe_rename() */
+       return rename(oldpath, real_newpath);
+}
 
 void
 mountlist_add(nfs_export *exp, const char *path)