Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0dc29da7 authored by Christopher Ferris's avatar Christopher Ferris Committed by Automerger Merge Worker
Browse files

Do not write past end of inotify event structure. am: 855803fd 

Original change: https://googleplex-android-review.googlesource.com/c/platform/bootable/recovery/+/16034931

Change-Id: Ifd7442160ed9b80767eeeba85f4f7466c8de8b2e
parents 24f04c87 855803fd

minui/events.cpp

+5 −3
Original line number Diff line number Diff line
@@ -29,7 +29,9 @@ 


#include <functional>

#include <memory>

#include <string>



#include <android-base/strings.h>

#include <android-base/unique_fd.h>



#include "minui/minui.h"
@@ -118,12 +120,12 @@ static int inotify_cb(int fd, __unused uint32_t epevents) { 
    }

    offset += sizeof(inotify_event) + pevent->len;



    pevent->name[pevent->len] = '\0';

    if (strncmp(pevent->name, "event", 5)) {

    std::string event_name(pevent->name, pevent->len);

    if (!android::base::StartsWith(event_name, "event")) {

      continue;

    }



    android::base::unique_fd dfd(openat(dirfd(dir.get()), pevent->name, O_RDONLY));

    android::base::unique_fd dfd(openat(dirfd(dir.get()), event_name.c_str(), O_RDONLY));

    if (dfd == -1) {

      break;

    }