Fix ext2 symlink bug.

rip->i_size is a target length without trailing '\0'.

Reported by Ben Gras.

diff --git a/servers/ext2/link.c b/servers/ext2/link.c
index 34d67db5414c721091789967c593fb7c09d5e457..6d14a77e459ab6813b0eff9b3bb2eb1197b6a975 100644 (file)
--- a/servers/ext2/link.c
+++ b/servers/ext2/link.c
@@ -195,7 +195,7 @@ PUBLIC int fs_rdlink()
   if( (rip = get_inode(fs_dev, (ino_t) fs_m_in.REQ_INODE_NR)) == NULL)
          return(EINVAL);
 
-  if (rip->i_size > MAX_FAST_SYMLINK_LENGTH) {
+  if (rip->i_size >= MAX_FAST_SYMLINK_LENGTH) {
   /* normal symlink */
        if ((b = read_map(rip, (off_t) 0)) == NO_BLOCK) {
                r = EIO;

diff --git a/servers/ext2/path.c b/servers/ext2/path.c
index e87bf87369696767ec24cfcbce299e900c8db518..6b44433d901bf0c27c4b92439e77f751078cc182 100644 (file)
--- a/servers/ext2/path.c
+++ b/servers/ext2/path.c
@@ -305,7 +305,7 @@ char *suffix;                       /* current remaining path. Has to point in the
 
   llen = (size_t) rip->i_size;
 
-  if (llen > MAX_FAST_SYMLINK_LENGTH) {
+  if (llen >= MAX_FAST_SYMLINK_LENGTH) {
        /* normal symlink */
        if ((blink = read_map(rip, (off_t) 0)) == NO_BLOCK)
                return(EIO);
@@ -358,7 +358,7 @@ char *suffix;                       /* current remaining path. Has to point in the
   /* Everything is set, now copy the expanded link to user_path */
   memmove(user_path, sp, llen);
 
-  if (llen > MAX_FAST_SYMLINK_LENGTH)
+  if (llen >= MAX_FAST_SYMLINK_LENGTH)
        put_block(bp, DIRECTORY_BLOCK);
 
   return(OK);