|
 |
744642 |
From 2a7af30793f9aa6e36acdc7c8b908d0965585437 Mon Sep 17 00:00:00 2001
|
|
|
744642 |
From: Jason Gerecke <killertofu@gmail.com>
|
|
|
744642 |
Date: Thu, 10 Oct 2019 12:13:39 -0700
|
|
|
744642 |
Subject: [PATCH] tools: Fix potential buffer overflow when reading from serial
|
|
|
744642 |
tablet
|
|
|
744642 |
|
|
|
744642 |
The read_data() function has a "min_len" number of bytes to read
|
|
|
744642 |
to ensure that a complete data structure is read, regardless of garbage
|
|
|
744642 |
that may be on the line. When garbage is present, however, it can
|
|
|
744642 |
potentially overflow the buffer.
|
|
|
744642 |
|
|
|
744642 |
The function already has code to memmove the good data over garbage and
|
|
|
744642 |
perform re-reads until "min_len" bytes of good data are available. All
|
|
|
744642 |
we need to do to avoid the buffer overflow is ensure that the maximum
|
|
|
744642 |
number of bytes we read() in one call is no more than the number of
|
|
|
744642 |
bytes free at the end of the buffer.
|
|
|
744642 |
|
|
|
744642 |
Ref: https://github.com/linuxwacom/xf86-input-wacom/issues/86
|
|
|
744642 |
Fixes: 3546d8ab1b ("tools: add isdv4-serial-debugger test program")
|
|
|
744642 |
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
|
|
|
744642 |
---
|
|
|
744642 |
tools/tools-shared.c | 2 +-
|
|
|
744642 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
744642 |
|
|
|
744642 |
diff --git a/tools/tools-shared.c b/tools/tools-shared.c
|
|
|
744642 |
index c55e8ca1..c10d8e86 100644
|
|
|
744642 |
--- a/tools/tools-shared.c
|
|
|
744642 |
+++ b/tools/tools-shared.c
|
|
|
744642 |
@@ -219,7 +219,7 @@ int read_data(int fd, unsigned char* buffer, int min_len)
|
|
|
744642 |
TRACE("Reading %d bytes from device.\n", min_len);
|
|
|
744642 |
redo:
|
|
|
744642 |
do {
|
|
|
744642 |
- int l = read(fd, &buffer[len], min_len);
|
|
|
744642 |
+ int l = read(fd, &buffer[len], min_len - len);
|
|
|
744642 |
|
|
|
744642 |
if (l == -1) {
|
|
|
744642 |
if (errno != EAGAIN) {
|
|
|
744642 |
--
|
|
|
744642 |
2.23.0
|
|
|
744642 |
|