fabrics: Avoid buffer overrun in strchomp

strchomp() has an off-by-one error and starts stripping spaces at the
byte AFTER the end of the buffer.

Signed-off-by: Daniel Wagner <dwagner@suse.de>

diff --git a/src/nvme/fabrics.c b/src/nvme/fabrics.c
index 0e8e9dc1c2800c704ad94a570a65f0e6716ac492..7134dbae8decf9f62c6f12b43cb87ff90c4f9498 100644 (file)
--- a/src/nvme/fabrics.c
+++ b/src/nvme/fabrics.c
@@ -47,13 +47,19 @@ const char *nvmf_dev = "/dev/nvme-fabrics";
 
 /**
  * strchomp() - Strip trailing white space
- * @s: String to strip
- * @l: Maximum length of string
+ * @str: String to strip
+ * @max: Maximum length of string
  */
-static void strchomp(char *s, int l)
+static void strchomp(char *str, int max)
 {
-       while (l && (s[l] == '\0' || s[l] == ' '))
-               s[l--] = '\0';
+       int i;
+
+       for (i = max - 1; i >= 0; i--) {
+               if (str[i] != '\0' && str[i] != ' ')
+                       return;
+               else
+                       str[i] = '\0';
+       }
 }
 
 const char *arg_str(const char * const *strings,