fix read after string end

outs is not a zero-terminated string but has its length given by
outslen, so use that (with a maximum of the size of msg)

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

diff --git a/RADOS.xs b/RADOS.xs
index f3f55162dcbdb1fa2ca612c8915d57a6a7737562..7eca024c70b2ee808598b11475b7b392b3f38573 100644 (file)
--- a/RADOS.xs
+++ b/RADOS.xs
@@ -131,8 +131,14 @@ CODE:
 
     if (ret < 0) {
         char msg[4096];
-        snprintf(msg, sizeof(msg), "mon_command failed - %s\n", outs);
+        if (outslen > sizeof(msg)) {
+            outslen = sizeof(msg);
+        }
+        snprintf(msg, sizeof(msg), "mon_command failed - %.*s\n", (int)outslen, outs);
         rados_buffer_free(outs);
+        if (outbuf != NULL) {
+            rados_buffer_free(outbuf);
+        }
         die(msg);
     }