[PATCH stalld 49/52] stalld: fix missing null-termination in is_runnable

Wander Lairson Costa <[email protected]> Mon, 8 Jun 2026 15:31:59 -0300
Newsgroups org.kernel.vger.linux-rt-users
Message-ID <[email protected]>
is_runnable() reads /proc/PID/stat into a fixed-size buffer using the
full buffer length. If read() returns exactly sizeof(stat) bytes the
conditional null-termination is skipped, leaving the buffer without a
terminator. The subsequent skipchars() and skipspaces() calls then
read past the array bounds.

Reduce the read length by one byte to guarantee space for the
terminator and null-terminate unconditionally.

Signed-off-by: Wander Lairson Costa <[email protected]>
---
 src/sched_debug.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/sched_debug.c b/src/sched_debug.c
index 7d79255..d5fbf6d 100644
--- a/src/sched_debug.c
+++ b/src/sched_debug.c
@@ -319,13 +319,12 @@ static int is_runnable(int pid)
 		goto out_error;
 	}
 	flock(fd, LOCK_SH);
-	retval = read(fd, &stat, sizeof(stat));
+	retval = read(fd, &stat, sizeof(stat) - sizeof(*stat));
 	if (retval < 0) {
 		warn("error reading stat for task %d\n", pid);
 		goto out_close_fd;
 	}
-	if (retval < sizeof(stat))
-		stat[retval] = '\0';
+	stat[retval] = '\0';
 
 	/*
 	 * The process state is the third white-space delimited field
-- 
2.54.0