generator: fix off-by-one length in read_delay_line()

A '!'-prefixed delete-delay entry computed one byte short, dropping the
final character of the name.

Co-authored-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Andrew TridgellandGreg Kroah-Hartman committed 2026-06-22 09:21:59 +10:00
1 parent 69eef72ecb
commit 422fc5aff8
1 file changed
+5 -1
+5 -1
View File
@@ -238,7 +238,11 @@ static int read_delay_line(char *buf, int *flags_p)
goto invalid_data;
}
past_space++;
len = j - read_pos - (past_space - bp) + 1; /* count the '\0' */
/* Name length + NUL. Computed from past_space directly: the old
* `j - read_pos - (past_space - bp)` form was off by +1 when a '!'
* prefix had advanced bp past read_pos, over-reading deldelay_buf
* by one byte on a buffer-filling final entry. */
len = (deldelay_buf + j) - past_space + 1;
read_pos = j + 1;
if (len > MAXPATHLEN) {