From 778c0e3a6cd25ef19c0c520b2e14311526254bd5 Mon Sep 17 00:00:00 2001 From: Syed Mohammed Nayyar Date: Sun, 28 Jun 2026 16:52:43 +0530 Subject: [PATCH] portable: leave room for trailing NUL in metadata receive buffer receive_portable_metadata() reads each item into a stack buffer of PATH_MAX + NAME_MAX + 2 bytes, passes the full sizeof() as the recv iovec length, and then NUL-terminates with iov_buffer[n] = 0. recvmsg() can return n equal to the buffer size, so the terminator is written one byte past the end. Grow the buffer by one byte and cap the iovec at sizeof - 1, so a full record is still received and the trailing NUL always fits, matching the coredump-receive.c reader. --- src/portable/portable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/portable/portable.c b/src/portable/portable.c index 9d510118be..f0bdb40fd2 100644 --- a/src/portable/portable.c +++ b/src/portable/portable.c @@ -214,8 +214,8 @@ static int receive_portable_metadata( * but according to suggestions from the SELinux people this will change and it will probably * be identical to NAME_MAX. For now we use that, but this should be updated one day when the * final limit is known. */ - char iov_buffer[PATH_MAX + NAME_MAX + 2]; - struct iovec iov = IOVEC_MAKE(iov_buffer, sizeof(iov_buffer)); + char iov_buffer[PATH_MAX + NAME_MAX + 2 + 1]; /* One extra byte for the trailing NUL we add below. */ + struct iovec iov = IOVEC_MAKE(iov_buffer, sizeof(iov_buffer) - 1); ssize_t n = receive_one_fd_iov(socket_fd, &iov, 1, 0, &fd); if (n == -EIO)