Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db4638ee authored by Daniel Rosenberg's avatar Daniel Rosenberg
Browse files

Fix overflow in path building 

An incorrect size was causing an unsigned value
to wrap, causing it to write past the end of
the buffer.

Bug: 28085658
Change-Id: Ie9625c729cca024d514ba2880ff97209d435a165
parent a3a7a886

sdcard/sdcard.c

+1 −1
Original line number Diff line number Diff line
@@ -341,7 +341,7 @@ static ssize_t get_node_path_locked(struct node* node, char* buf, size_t bufsize 


    ssize_t pathlen = 0;

    if (node->parent && node->graft_path == NULL) {

        pathlen = get_node_path_locked(node->parent, buf, bufsize - namelen - 2);

        pathlen = get_node_path_locked(node->parent, buf, bufsize - namelen - 1);

        if (pathlen < 0) {

            return -1;

        }