From 79a695f24fd19c35a4fe214c42073725dbff1473 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 16 Sep 2017 08:38:28 +0200 Subject: [PATCH] udev: fix buffer overflow in udev_event_apply_format() Fixes #6664. --- src/udev/udev-event.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c index 601f0ee13d1..09f7baf0822 100644 --- a/src/udev/udev-event.c +++ b/src/udev/udev-event.c @@ -362,7 +362,7 @@ size_t udev_event_apply_format(struct udev_event *event, } copy: /* copy char */ - if (l == 0) + if (l < 2) /* need space for this char and the terminating NUL */ goto out; s[0] = from[0]; from++; @@ -377,12 +377,12 @@ subst: unsigned int i; from++; - for (i = 0; from[i] != '}'; i++) { + for (i = 0; from[i] != '}'; i++) if (from[i] == '\0') { log_error("missing closing brace for format '%s'", src); goto out; } - } + if (i >= sizeof(attrbuf)) goto out; memcpy(attrbuf, from, i); @@ -407,6 +407,7 @@ subst: } out: + assert(l >= 1); s[0] = '\0'; return l; } -- 2.47.3