2002-11-27 Chip Salzenberg <chip@pobox.com>

	* utils/mountd/rmtab.c (slink_safe_rename): Fix off-by-one buffer
	overflow bug.  Reformat per rest of source file.

1 files changed, 14 insertions, 23 deletions

diff --git a/utils/mountd/rmtab.c b/utils/mountd/rmtab.c
index 0a4ed4c..869b5f8 100644
--- a/utils/mountd/rmtab.c
+++ b/utils/mountd/rmtab.c
@@ -29,30 +29,21 @@
 static int 
 slink_safe_rename(const char * oldpath, const char * newpath)
 {
-  int r;
-  struct stat s;
-  char slink_path[PATH_MAX];
-  char real_newpath = newpath;
-
-  if((lstat(newpath, &s) == 0) && (S_ISLNK(s.st_mode))) {
-
-    /* New path is a symbolic link, do not destroy but follow */
-
-    if((r = readlink(newpath, slink_path, PATH_MAX))==-1) {
-
-      return -1;
-
-    }
-
-    slink_path[ (r < PATH_MAX) ? (r + 1) : (PATH_MAX - 1)] = '\0';
-
-    real_newpath = slink_path;
-
-  }
-
-  return rename(oldpath, real_newpath);
+	int r;
+	struct stat s;
+	char slink_path[PATH_MAX];
+	char real_newpath = newpath;
+
+	if ((lstat(newpath, &s) == 0) && S_ISLNK(s.st_mode)) {
+		/* New path is a symbolic link, do not destroy but follow */
+		if ((r = readlink(newpath, slink_path, PATH_MAX - 1)) == -1)
+			return -1;
+		slink_path[r] = '\0';
+		real_newpath = slink_path;
+	}
 
-}/* static int slink_safe_rename() */
+	return rename(oldpath, real_newpath);
+}
 
 void
 mountlist_add(nfs_export *exp, const char *path)