tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

tools/mm/slabinfo: fix access to null terminator in string boundary

The current code incorrectly accesses buffer[strlen(buffer)], which points
to the null terminator ('\0') at the end of the string. This is
technically out-of-bounds access since valid string content ends at index
strlen(buffer)-1.

Fix by:
1. Declaring strlen() result variable at function scope
2. Adding bounds check (len > 0) to handle empty strings
3. Using buffer[len-1] to correctly access the last character before
the null terminator

[kaushlendra.kumar@intel.com: remove unnecessary blank line]
Link: https://lkml.kernel.org/r/20250901044955.3902815-1-kaushlendra.kumar@intel.com
Link: https://lkml.kernel.org/r/20250830172022.1927448-1-kaushlendra.kumar@intel.com
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Acked-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Kaushlendra Kumar and committed by
Andrew Morton 4fa5b88e 5a00878f

+5 -2
+5 -2
tools/mm/slabinfo.c
··· 155 155 156 156 static unsigned long read_obj(const char *name) 157 157 { 158 + size_t len; 158 159 FILE *f = fopen(name, "r"); 159 160 160 161 if (!f) { ··· 166 165 if (!fgets(buffer, sizeof(buffer), f)) 167 166 buffer[0] = 0; 168 167 fclose(f); 169 - if (buffer[strlen(buffer)] == '\n') 170 - buffer[strlen(buffer)] = 0; 168 + len = strlen(buffer); 169 + 170 + if (len > 0 && buffer[len - 1] == '\n') 171 + buffer[len - 1] = 0; 171 172 } 172 173 return strlen(buffer); 173 174 }