i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

driver_settings: bufferSize being zero means buffer overflow

Browse Source 
Change-Id: I87b4a57c651840ac6aa01d602eddabb192c8c323
Reviewed-on: https://review.haiku-os.org/c/haiku/+/9116
Tested-by: Commit checker robot <[email protected]>
Reviewed-by: waddlesplash <[email protected]>
This commit is contained in:
Jérôme Duval
2025-03-11 02:15:39 +00:00
committed by waddlesplash
parent 63792e3fd0
commit 778fe0b67b
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/system/libroot/os/driver_settings.cpp
+9 -8
View File
@@ -525,11 +525,12 @@ put_chars(char **_buffer, size_t *_bufferSize, const char *chars)
return true;
length = strlen(chars);
*_bufferSize -= length;
if (*_bufferSize <= 0)
if (*_bufferSize <= length) {
*_bufferSize = 0;
return false;
}
*_bufferSize -= length;
memcpy(buffer, chars, length);
buffer += length;
buffer[0] = '\0';
@@ -546,11 +547,12 @@ put_char(char **_buffer, size_t *_bufferSize, char c)
{
char *buffer = *_buffer;
*_bufferSize -= 1;
if (*_bufferSize <= 0)
if (*_bufferSize <= 1) {
*_bufferSize = 0;
return false;
}
*_bufferSize -= 1;
buffer[0] = c;
buffer[1] = '\0';
@@ -872,8 +874,7 @@ get_driver_settings_string(void *_handle, char *buffer, size_t *_bufferSize,
0, flat);
}
*_bufferSize -= bufferSize;
return bufferSize >= 0 ? B_OK : B_BUFFER_OVERFLOW;
return bufferSize > 0 ? B_OK : B_BUFFER_OVERFLOW;
}