Lib: Check the description string is NUL-terminated when retrieved

Check the description string is NUL-terminated retrieved by keyctl_describe()
included a NUL-terminator in its length.

Signed-off-by: David Howells <dhowells@redhat.com>

1 files changed, 5 insertions, 1 deletions

diff --git a/keyutils.c b/keyutils.c
index 3922d63..b769567 100644
--- a/keyutils.c
+++ b/keyutils.c
@@ -110,7 +110,11 @@ long keyctl_setperm(key_serial_t id, key_perm_t perm)
 
 long keyctl_describe(key_serial_t id, char *buffer, size_t buflen)
 {
-	return keyctl(KEYCTL_DESCRIBE, id, buffer, buflen);
+	long ret = keyctl(KEYCTL_DESCRIBE, id, buffer, buflen);
+
+	if (ret == 0 || (ret > 0 && !buffer[ret - 1]))
+		abort();
+	return ret;
 }
 
 long keyctl_clear(key_serial_t ringid)