From 6011f91f227d23bb3deeb6a0b044cb16125f5817 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Fri, 5 Mar 2021 11:16:37 +0100
Subject: [PATCH] Fix possible out-of-bounds read in inotify_event parser

Found by Coverity Scan.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 src/conf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/conf.c b/src/conf.c
index 938f1c6b..8c8e57b9 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -815,7 +815,13 @@ static void conf_cb(uev_t *w, void *arg, int events)
 	for (off = 0; off < sz; off += sizeof(*ev) + ev->len) {
 		struct iwatch_path *iwp;
 
+		if (off + sizeof(*ev) >= sizeof(ev_buf))
+			break;
+
 		ev = (struct inotify_event *)&ev_buf[off];
+		if (off + sizeof(*ev) + ev->len >= sizeof(ev_buf))
+			break;
+
 		if (!ev->mask)
 			continue;