Buffer overun

Because readlink() does not null-terminate buffer, only return
number of written chars, thare is possibility that buf[ret] = 0;
will write to unallocated area.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 1 insertions, 1 deletions

diff --git a/usbmisc.c b/usbmisc.c
index c6179c1..4c5612a 100644
--- a/usbmisc.c
+++ b/usbmisc.c
@@ -42,7 +42,7 @@ static int readlink_recursive(const char *path, char *buf, size_t bufsize)
 	char *ptemp;
 	int ret;
 
-	ret = readlink(path, buf, bufsize);
+	ret = readlink(path, buf, bufsize-1);
 
 	if (ret > 0) {
 		buf[ret] = 0;