Skip to content

Commit 6f75146

Browse files
fix(linux): fix off-by-one buffer overflow in process_parse_stat (#2324)
When slash_pos is 0 (executable path starts with '/'), the null terminator was written to cmdline_procname[BUFFER_LEN], which is one byte past the end of the array. Subtract 1 from both the strncpy length and the null terminator index so they are always within the [0, BUFFER_LEN-1] bounds of the buffer. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 451dd43 commit 6f75146

1 file changed

Lines changed: 3 additions & 2 deletions

File tree

src/data/os/linux.cc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3026,8 +3026,9 @@ static void process_parse_stat(struct process *process) {
30263026
strncpy(cmdline_procname, cmdline, BUFFER_LEN);
30273027
} else {
30283028
long int slash_pos = slash_ptr - tmpstr;
3029-
strncpy(cmdline_procname, cmdline + slash_pos + 1, BUFFER_LEN - slash_pos);
3030-
cmdline_procname[BUFFER_LEN - slash_pos] = 0;
3029+
strncpy(cmdline_procname, cmdline + slash_pos + 1,
3030+
BUFFER_LEN - slash_pos - 1);
3031+
cmdline_procname[BUFFER_LEN - slash_pos - 1] = 0;
30313032
}
30323033

30333034
/* Extract cpu times from data in /proc filesystem */

0 commit comments

Comments
 (0)