wt/finit
1
0
Fork 0
mirror of https://github.com/troglobit/finit.git synced 2026-10-02 05:52:48 +07:00
Code Issues Packages Projects Releases Wiki Activity

plugins: tty: validate against read() length, not buffer size

Browse Source 
Fix ev->len validation; must check against sz read(), not total buffer
size.  Also, fix off-by-one in comparison.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2021-03-07 12:55:12 +01:00
parent 35b200d3a9
commit e44dfde54e
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/tty.c
+5 -4
View File
@@ -72,7 +72,8 @@ static void watcher(void *arg, int fd, int events)
{
static char ev_buf[8 *(sizeof(struct inotify_event) + NAME_MAX + 1) + 1];
struct inotify_event *ev;
ssize_t sz, off;
ssize_t sz;
size_t off;
sz = read(fd, ev_buf, sizeof(ev_buf) - 1);
if (sz <= 0) {
@@ -81,12 +82,12 @@ static void watcher(void *arg, int fd, int events)
}
ev_buf[sz] = 0;
for (off = 0; off < sz; off += sizeof(*ev) + ev->len) {
if (off + sizeof(*ev) >= sizeof(ev_buf))
for (off = 0; off < (size_t)sz; off += sizeof(*ev) + ev->len) {
if (off + sizeof(*ev) > (size_t)sz)
break;
ev = (struct inotify_event *)&ev_buf[off];
if (off + sizeof(*ev) + ev->len >= sizeof(ev_buf))
if (off + sizeof(*ev) + ev->len > (size_t)sz)
break;
if (!ev->mask)