Skip to content

Commit 64b778b

Browse files
hidraw: fix number of bytes to copy from uevent in parse_uevent_info (#497)
Commit 5c9f147 (#432) replaced a call to strdup with an explicit memcpy to a buffer on the stack. However, it incorrectly used the buffer size, instead of the clamped uevent length, as the argument to memcpy, resulting in reads past the end of uevent: Fix this by using uevent_len as the argument to memcpy. Calling strndupa was considered but abandoned, as it is not standard. Fixes: 5c9f147 (#432) Fixes: 4779d63
1 parent fa8b961 commit 64b778b

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

linux/hid.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -403,7 +403,7 @@ static int parse_hid_vid_pid_from_uevent(const char *uevent, unsigned *bus_type,
403403
size_t uevent_len = strlen(uevent);
404404
if (uevent_len > sizeof(tmp) - 1)
405405
uevent_len = sizeof(tmp) - 1;
406-
memcpy(tmp, uevent, sizeof(tmp));
406+
memcpy(tmp, uevent, uevent_len);
407407
tmp[uevent_len] = '\0';
408408

409409
char *saveptr = NULL;
@@ -493,7 +493,7 @@ static int parse_uevent_info(const char *uevent, unsigned *bus_type,
493493
size_t uevent_len = strlen(uevent);
494494
if (uevent_len > sizeof(tmp) - 1)
495495
uevent_len = sizeof(tmp) - 1;
496-
memcpy(tmp, uevent, sizeof(tmp));
496+
memcpy(tmp, uevent, uevent_len);
497497
tmp[uevent_len] = '\0';
498498

499499
char *saveptr = NULL;

0 commit comments

Comments
 (0)