From e44dfde54e73250c8fede8a97f3e79348fc942a9 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Sun, 7 Mar 2021 12:53:37 +0100 Subject: [PATCH] plugins: tty: validate against read() length, not buffer size Fix ev->len validation; must check against sz read(), not total buffer size. Also, fix off-by-one in comparison. Signed-off-by: Joachim Wiberg --- plugins/tty.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/plugins/tty.c b/plugins/tty.c index 86a1917b..8f9a5526 100644 --- a/plugins/tty.c +++ b/plugins/tty.c @@ -72,7 +72,8 @@ static void watcher(void *arg, int fd, int events) { static char ev_buf[8 *(sizeof(struct inotify_event) + NAME_MAX + 1) + 1]; struct inotify_event *ev; - ssize_t sz, off; + ssize_t sz; + size_t off; sz = read(fd, ev_buf, sizeof(ev_buf) - 1); if (sz <= 0) { @@ -81,12 +82,12 @@ static void watcher(void *arg, int fd, int events) } ev_buf[sz] = 0; - for (off = 0; off < sz; off += sizeof(*ev) + ev->len) { - if (off + sizeof(*ev) >= sizeof(ev_buf)) + for (off = 0; off < (size_t)sz; off += sizeof(*ev) + ev->len) { + if (off + sizeof(*ev) > (size_t)sz) break; ev = (struct inotify_event *)&ev_buf[off]; - if (off + sizeof(*ev) + ev->len >= sizeof(ev_buf)) + if (off + sizeof(*ev) + ev->len > (size_t)sz) break; if (!ev->mask)