Skip to content

Commit 88472be

Browse files
kaushlenakpm00
authored andcommitted
tools/mm/slabinfo: fix access to null terminator in string boundary
The current code incorrectly accesses buffer[strlen(buffer)], which points to the null terminator ('\0') at the end of the string. This is technically out-of-bounds access since valid string content ends at index strlen(buffer)-1. Fix by: 1. Declaring strlen() result variable at function scope 2. Adding bounds check (len > 0) to handle empty strings 3. Using buffer[len-1] to correctly access the last character before the null terminator Link: https://lkml.kernel.org/r/20250830172022.1927448-1-kaushlendra.kumar@intel.com Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com> Acked-by: SeongJae Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
1 parent 3fe5a59 commit 88472be

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

tools/mm/slabinfo.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,8 @@ static void usage(void)
155155

156156
static unsigned long read_obj(const char *name)
157157
{
158+
size_t len;
159+
158160
FILE *f = fopen(name, "r");
159161

160162
if (!f) {
@@ -165,8 +167,10 @@ static unsigned long read_obj(const char *name)
165167
if (!fgets(buffer, sizeof(buffer), f))
166168
buffer[0] = 0;
167169
fclose(f);
168-
if (buffer[strlen(buffer)] == '\n')
169-
buffer[strlen(buffer)] = 0;
170+
len = strlen(buffer);
171+
172+
if (len > 0 && buffer[len - 1] == '\n')
173+
buffer[len - 1] = 0;
170174
}
171175
return strlen(buffer);
172176
}

0 commit comments

Comments
 (0)