From 35b200d3a9b0718eda712777ae56af5002392306 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Sun, 7 Mar 2021 12:52:16 +0100 Subject: [PATCH] Validate inotify event against read() length, not buffer size Fix ev->len validation; must check against sz read(), not total buffer size. Also, fix off-by-one in comparison. Signed-off-by: Joachim Wiberg --- src/conf.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/conf.c b/src/conf.c index 8c8e57b9..f34cf34a 100644 --- a/src/conf.c +++ b/src/conf.c @@ -803,7 +803,8 @@ static void conf_cb(uev_t *w, void *arg, int events) { static char ev_buf[8 *(sizeof(struct inotify_event) + NAME_MAX + 1) + 1]; struct inotify_event *ev; - ssize_t sz, off; + ssize_t sz; + size_t off; sz = read(w->fd, ev_buf, sizeof(ev_buf) - 1); if (sz <= 0) { @@ -812,14 +813,14 @@ static void conf_cb(uev_t *w, void *arg, int events) } ev_buf[sz] = 0; - for (off = 0; off < sz; off += sizeof(*ev) + ev->len) { + for (off = 0; off < (size_t)sz; off += sizeof(*ev) + ev->len) { struct iwatch_path *iwp; - if (off + sizeof(*ev) >= sizeof(ev_buf)) + if (off + sizeof(*ev) > (size_t)sz) break; ev = (struct inotify_event *)&ev_buf[off]; - if (off + sizeof(*ev) + ev->len >= sizeof(ev_buf)) + if (off + sizeof(*ev) + ev->len > (size_t)sz) break; if (!ev->mask)