Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 943ef23b authored by Spencer Low's avatar Spencer Low
Browse files

adbd: tcpip command uses port number from uninitialized memory



If you run `adb tcpip`, adbd tries to process a string of 'tcpip:' using
this code:

    } else if(!strncmp(name, "tcpip:", 6)) {
        int port;
        if (sscanf(name + 6, "%d", &port) == 0) {
            port = 0;
        }
        ret = create_service_thread(restart_tcp_service, (void *) (uintptr_t) port);

If a zero-length string is passed to sscanf(), it returns EOF (-1) which
causes the if statement to skip the block, leaving the port variable
uninitialized.

I found this by running `adb tcpip` and sometimes getting 'invalid port'
and sometimes a device would start listening on a random port number.

The fix is to check the sscanf() return value for the success case (the
number of items successfully parsed), as is already done in other parts
of the adb code. I also fixed-up another instance of the same
code-pattern in services.c.

Change-Id: I8c9c33485ad076828da0ac74f048fdad561669d3
Signed-off-by: default avatarSpencer Low <CompareAndSwap@gmail.com>
parent e21d7ae8
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment