stec-inc/EnhanceIO — pull request #13 by meyering (2013-02-17 20:50:15+00:00)
Title: don't read beyond end of buffer for strlen(cache_name) > 31

* eio_ttc.c (eio_cache_rec_fill): Ensure that rec->cr_name is
always NUL-terminated. It would lack a trailing NUL whenever
strlen(dmc->cache_name) > CACHE_NAME_LEN. The length of the
cache_name string may be up to DEV_PATHLEN-1 (127), while the
shorter destination buffer has length CACHE_NAME_SZ, 32.
Each subsequent use of that cr_name member requires that it be
NUL-terminated, so any use would read beyond end of buffer.

Signed-off-by: Jim Meyering