diff options
| author | Christopher Ferris <cferris@google.com> | 2021-10-08 12:05:31 -0700 |
|---|---|---|
| committer | Kelvin Zhang <zhangkelvin@google.com> | 2021-10-11 19:11:05 +0000 |
| commit | 187a6ec5483e2102568a904cc091e3eba5a00187 (patch) | |
| tree | d29110f02a00665a9296772627d02f532c5ff41b | |
| parent | 2a4893e165d98498bb5604584e241ed7c328dee3 (diff) | |
Do not write past end of inotify event structure.
Bug: 202159709
Test: None yet.
Change-Id: If80ed957aaa93c03a97b57e818e7783fa6e38242
(cherry picked from commit ce87c786116557e89f9da95f550d6816aeaca67e)
| -rw-r--r-- | minui/events.cpp | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/minui/events.cpp b/minui/events.cpp index 87f81122..863ac747 100644 --- a/minui/events.cpp +++ b/minui/events.cpp @@ -29,7 +29,9 @@ #include <functional> #include <memory> +#include <string> +#include <android-base/strings.h> #include <android-base/unique_fd.h> #include "minui/minui.h" @@ -118,12 +120,12 @@ static int inotify_cb(int fd, __unused uint32_t epevents) { } offset += sizeof(inotify_event) + pevent->len; - pevent->name[pevent->len] = '\0'; - if (strncmp(pevent->name, "event", 5)) { + std::string event_name(pevent->name, pevent->len); + if (!android::base::StartsWith(event_name, "event")) { continue; } - android::base::unique_fd dfd(openat(dirfd(dir.get()), pevent->name, O_RDONLY)); + android::base::unique_fd dfd(openat(dirfd(dir.get()), event_name.c_str(), O_RDONLY)); if (dfd == -1) { break; } |