From 4806f7c308ebdc14fa650ff232ccaa33756fd73f Mon Sep 17 00:00:00 2001 From: Evgeniy Ivanov Date: Mon, 29 Aug 2011 23:36:48 +0400 Subject: [PATCH] Fix ext2 symlink bug. rip->i_size is a target length without trailing '\0'. Reported by Ben Gras. --- servers/ext2/link.c | 2 +- servers/ext2/path.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/servers/ext2/link.c b/servers/ext2/link.c index 34d67db54..6d14a77e4 100644 --- a/servers/ext2/link.c +++ b/servers/ext2/link.c @@ -195,7 +195,7 @@ PUBLIC int fs_rdlink() if( (rip = get_inode(fs_dev, (ino_t) fs_m_in.REQ_INODE_NR)) == NULL) return(EINVAL); - if (rip->i_size > MAX_FAST_SYMLINK_LENGTH) { + if (rip->i_size >= MAX_FAST_SYMLINK_LENGTH) { /* normal symlink */ if ((b = read_map(rip, (off_t) 0)) == NO_BLOCK) { r = EIO; diff --git a/servers/ext2/path.c b/servers/ext2/path.c index e87bf8736..6b44433d9 100644 --- a/servers/ext2/path.c +++ b/servers/ext2/path.c @@ -305,7 +305,7 @@ char *suffix; /* current remaining path. Has to point in the llen = (size_t) rip->i_size; - if (llen > MAX_FAST_SYMLINK_LENGTH) { + if (llen >= MAX_FAST_SYMLINK_LENGTH) { /* normal symlink */ if ((blink = read_map(rip, (off_t) 0)) == NO_BLOCK) return(EIO); @@ -358,7 +358,7 @@ char *suffix; /* current remaining path. Has to point in the /* Everything is set, now copy the expanded link to user_path */ memmove(user_path, sp, llen); - if (llen > MAX_FAST_SYMLINK_LENGTH) + if (llen >= MAX_FAST_SYMLINK_LENGTH) put_block(bp, DIRECTORY_BLOCK); return(OK); -- 2.44.0