Commit 64b778b
authored
hidraw: fix number of bytes to copy from uevent in parse_uevent_info (#497)
Commit 5c9f147 (#432) replaced a call to strdup with an explicit
memcpy to a buffer on the stack.
However, it incorrectly used the buffer size, instead of the clamped
uevent length, as the argument to memcpy, resulting in reads past the
end of uevent:
Fix this by using uevent_len as the argument to memcpy.
Calling strndupa was considered but abandoned, as it is not standard.
Fixes: 5c9f147 (#432)
Fixes: 4779d631 parent fa8b961 commit 64b778b
1 file changed
+2
-2
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
403 | 403 | | |
404 | 404 | | |
405 | 405 | | |
406 | | - | |
| 406 | + | |
407 | 407 | | |
408 | 408 | | |
409 | 409 | | |
| |||
493 | 493 | | |
494 | 494 | | |
495 | 495 | | |
496 | | - | |
| 496 | + | |
497 | 497 | | |
498 | 498 | | |
499 | 499 | | |
| |||
0 commit comments