[PATCH] Fix lsusb out-of-bounds write

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



If read_sysfs_file_string() encounters a zero-length file, it will write
'\0' at index -1 of the provided buffer. Handle zero-length files
gracefully by falling through to the error handler which does the right
thing (tm).

Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@xxxxxxx>

diff --git a/lsusb-t.c b/lsusb-t.c
index 8bcdbf1..5438704 100644
--- a/lsusb-t.c
+++ b/lsusb-t.c
@@ -235,7 +235,7 @@ static void read_sysfs_file_string(const char *d_name, const char *file, char *b
 		goto error;
 	r = read(fd, buf, len);
 	close(fd);
-	if (r >= 0 && r < len) {
+	if (r > 0 && r < len) {
 		buf[r] = '\0';
 		r--;
 		while (buf[r] == '\n') {


-- 
http://www.hailfinger.org/

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux