Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0a760b3 authored by Christopher Ferris's avatar Christopher Ferris Committed by Android Build Coastguard Worker
Browse files

Do not write past end of inotify event structure. 

Bug: 202159709

Test: None yet.
Change-Id: If80ed957aaa93c03a97b57e818e7783fa6e38242
(cherry picked from commit ce87c786)
(cherry picked from commit 85d7266a)
Merged-In:If80ed957aaa93c03a97b57e818e7783fa6e38242
parent 22a4fbc3

minui/events.cpp

+5 −3
Original line number Diff line number Diff line
@@ -29,7 +29,9 @@ 


#include <functional>

#include <memory>

#include <string>



#include <android-base/strings.h>

#include <android-base/unique_fd.h>



#include "minui/minui.h"
@@ -118,12 +120,12 @@ static int inotify_cb(int fd, __unused uint32_t epevents) { 
    }

    offset += sizeof(inotify_event) + pevent->len;



    pevent->name[pevent->len] = '\0';

    if (strncmp(pevent->name, "event", 5)) {

    std::string event_name(pevent->name, pevent->len);

    if (!android::base::StartsWith(event_name, "event")) {

      continue;

    }



    android::base::unique_fd dfd(openat(dirfd(dir.get()), pevent->name, O_RDONLY));

    android::base::unique_fd dfd(openat(dirfd(dir.get()), event_name.c_str(), O_RDONLY));

    if (dfd == -1) {

      break;

    }