Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 85d7266a authored by Christopher Ferris's avatar Christopher Ferris Committed by Kelvin Zhang
Browse files

Do not write past end of inotify event structure. 

Bug: 202159709

Test: None yet.
Change-Id: If80ed957aaa93c03a97b57e818e7783fa6e38242
(cherry picked from commit ce87c786)
parent 76eeeea9

minui/events.cpp

+5 −3
Original line number Diff line number Diff line
@@ -29,7 +29,9 @@ 


#include <functional>

#include <memory>

#include <string>



#include <android-base/strings.h>

#include <android-base/unique_fd.h>



#include "minui/minui.h"
@@ -118,12 +120,12 @@ static int inotify_cb(int fd, __unused uint32_t epevents) { 
    }

    offset += sizeof(inotify_event) + pevent->len;



    pevent->name[pevent->len] = '\0';

    if (strncmp(pevent->name, "event", 5)) {

    std::string event_name(pevent->name, pevent->len);

    if (!android::base::StartsWith(event_name, "event")) {

      continue;

    }



    android::base::unique_fd dfd(openat(dirfd(dir.get()), pevent->name, O_RDONLY));

    android::base::unique_fd dfd(openat(dirfd(dir.get()), event_name.c_str(), O_RDONLY));

    if (dfd == -1) {

      break;

    }