From 02a1b2d0148a9cfb6d9cae67eb4a3d8d5408a374 Mon Sep 17 00:00:00 2001 From: "Antonio S. Musumeci" Date: Sat, 18 Apr 2026 00:58:28 -0400 Subject: [PATCH] fuse_readlink: always null-terminate buffer Old code only null-terminated when the returned/copied length was strictly less than the caller-supplied bufsize_, leaving the buffer unterminated on an exact-fill. Since buf_ is consumed as a C string, reserve one byte for the terminator up front and unconditionally terminate. --- src/fuse_readlink.cpp | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/fuse_readlink.cpp b/src/fuse_readlink.cpp index 9f5e748d..7bd9f91a 100644 --- a/src/fuse_readlink.cpp +++ b/src/fuse_readlink.cpp @@ -40,12 +40,11 @@ _readlink_core_standard(const fs::path &fullpath_, { int rv; - rv = fs::readlink(fullpath_,buf_,bufsize_); + rv = fs::readlink(fullpath_,buf_,(bufsize_ - 1)); if(rv < 0) return rv; - if((size_t)rv < bufsize_) - buf_[rv] = '\0'; + buf_[rv] = '\0'; return 0; } @@ -71,10 +70,9 @@ _readlink_core_symlinkify(const fs::path &fullpath_, if(!symlinkify::can_be_symlink(st,symlinkify_timeout_)) return ::_readlink_core_standard(fullpath_,buf_,bufsize_); - n = std::min(fullpath_str.size(),bufsize_); + n = std::min(fullpath_str.size(),(bufsize_ - 1)); memcpy(buf_,fullpath_str.c_str(),n); - if(n < bufsize_) - buf_[n] = '\0'; + buf_[n] = '\0'; return 0; }