readlink() result buffer is not zero-terminated.

Therefore, as an extra paranoia step, zero-terminate
the readlink result buffer even before the result SV is created.

Also, readlink returns SSize_t, not int.

1 files changed, 7 insertions, 1 deletions

diff --git a/caretx.c b/caretx.c
index bf5ba85503..dffa445b3b 100644
--- a/caretx.c
+++ b/caretx.c
@@ -99,7 +99,13 @@ Perl_set_caret_X(pTHX) {
         }
 #  elif defined(HAS_PROCSELFEXE)
         char buf[MAXPATHLEN];
-        int len = readlink(PROCSELFEXE_PATH, buf, sizeof(buf) - 1);
+        Ssize_t len = readlink(PROCSELFEXE_PATH, buf, sizeof(buf) - 1);
+        /* NOTE: if the length returned by readlink() is sizeof(buf) - 1,
+         * it is impossible to know whether the result was truncated. */
+
+        if (len != -1) {
+            buf[len] = '\0';
+        }
 
         /* On Playstation2 Linux V1.0 (kernel 2.2.1) readlink(/proc/self/exe)
            includes a spurious NUL which will cause $^X to fail in system