Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 488880cb authored by Christopher Ferris's avatar Christopher Ferris Committed by Automerger Merge Worker
Browse files

Do not write past end of inotify event structure. am: 187a6ec5 

Original change: https://googleplex-android-review.googlesource.com/c/platform/bootable/recovery/+/16033753

Change-Id: I81f74aaebf9694113a2d24f5e31d4a8929e1efdd
parents 76eeeea9 187a6ec5

minui/events.cpp

+5 −3
Original line number Diff line number Diff line
@@ -29,7 +29,9 @@ 


#include <functional>

#include <memory>

#include <string>



#include <android-base/strings.h>

#include <android-base/unique_fd.h>



#include "minui/minui.h"
@@ -118,12 +120,12 @@ static int inotify_cb(int fd, __unused uint32_t epevents) { 
    }

    offset += sizeof(inotify_event) + pevent->len;



    pevent->name[pevent->len] = '\0';

    if (strncmp(pevent->name, "event", 5)) {

    std::string event_name(pevent->name, pevent->len);

    if (!android::base::StartsWith(event_name, "event")) {

      continue;

    }



    android::base::unique_fd dfd(openat(dirfd(dir.get()), pevent->name, O_RDONLY));

    android::base::unique_fd dfd(openat(dirfd(dir.get()), event_name.c_str(), O_RDONLY));

    if (dfd == -1) {

      break;

    }