Fix vsnprintf off-by-one bug

The recent vsnprintf() fix introduced an off-by-one, and it's now
possible to overrun the target buffer by one byte.

The "end" pointer points to past the end of the buffer, so if we
have to truncate the result, it needs to be done though "end[-1]".

[ This is just an alternate and simpler patch to one proposed by Andrew
  and Jeremy, who actually noticed the problem ]

Acked-by: Andrew Morton <akpm@osdl.org>
Acked-by: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 797428afd1114f3dc1ad3c239917b9f04ceccd55..bed7229378f2da073be0c25eda0a30bf07146380 100644 (file)
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -489,7 +489,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                if (str < end)
                        *str = '\0';
                else
-                       *end = '\0';
+                       end[-1] = '\0';
        }
        /* the trailing null byte doesn't count towards the total */
        return str-buf;