- Reduce buffer size from LINE_MAX to PATH_MAX, there is no point to store

   path longer than this.
 - Fix an unreached case of check against sizeof buf, which in turn leads
   to an off-by-one nul byte write on the stack.  The original condition
   can never be satisfied because the passed boundary is the maximum value
   that can be returned, so code was harmless.

MFC after:	1 month

1 files changed, 4 insertions, 8 deletions

diff --git a/lib/libc/gen/check_utility_compat.c b/lib/libc/gen/check_utility_compat.c
index 0ccdec1..04c594b 100644
--- a/lib/libc/gen/check_utility_compat.c
+++ b/lib/libc/gen/check_utility_compat.c
@@ -35,32 +35,28 @@ __FBSDID("$FreeBSD$");
  * are threaded, so I'm not concerned about cancellation points or other
  * niceties.
  */
+#include <sys/limits.h>
+
 #include <limits.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
-#ifndef LINE_MAX
-#define	LINE_MAX _POSIX2_LINE_MAX
-#endif
-
 #define	_PATH_UTIL_COMPAT	"/etc/compat-FreeBSD-4-util"
 #define	_ENV_UTIL_COMPAT	"_COMPAT_FreeBSD_4"
 
 int
 check_utility_compat(const char *utility)
 {
-	char buf[LINE_MAX];
+	char buf[PATH_MAX];
 	char *p, *bp;
 	int len;
 
 	if ((p = getenv(_ENV_UTIL_COMPAT)) != NULL) {
 		strlcpy(buf, p, sizeof buf);
 	} else {
-		if ((len = readlink(_PATH_UTIL_COMPAT, buf, sizeof buf)) < 0)
+		if ((len = readlink(_PATH_UTIL_COMPAT, buf, sizeof(buf) - 1)) < 0)
 			return 0;
-		if (len > sizeof buf)
-			len = sizeof buf;
 		buf[len] = '\0';
 	}
 	if (buf[0] == '\0')