readlink() result buffer is not zero-terminated.

Therefore, as an extra paranoia step, zero-terminate
the readlink result buffer even before the result SV is created.

Also, readlink returns SSize_t, not int.

1 files changed, 5 insertions, 1 deletions

diff --git a/pp_sys.c b/pp_sys.c
index 501146e3c6..e01cf487a3 100644
--- a/pp_sys.c
+++ b/pp_sys.c
@@ -3671,13 +3671,17 @@ PP(pp_readlink)
     dTARGET;
     const char *tmps;
     char buf[MAXPATHLEN];
-    int len;
+    SSize_t len;
 
     TAINT;
     tmps = POPpconstx;
+    /* NOTE: if the length returned by readlink() is sizeof(buf) - 1,
+     * it is impossible to know whether the result was truncated. */
     len = readlink(tmps, buf, sizeof(buf) - 1);
     if (len < 0)
 	RETPUSHUNDEF;
+    if (len != -1)
+        buf[len] = '\0';
     PUSHp(buf, len);
     RETURN;
 #else