i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

driver_settings: bufferSize being zero means buffer overflow

Browse Source 
Change-Id: I87b4a57c651840ac6aa01d602eddabb192c8c323
Reviewed-on: https://review.haiku-os.org/c/haiku/+/9116
Tested-by: Commit checker robot <[email protected]>
Reviewed-by: waddlesplash <[email protected]>
This commit is contained in:
Jérôme Duval
2025-03-11 02:15:39 +00:00
committed by waddlesplash
parent 63792e3fd0
commit 778fe0b67b
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/system/libroot/os/driver_settings.cpp
+9 -8
View File
@@ -525,11 +525,12 @@ put_chars(char **_buffer, size_t *_bufferSize, const char *chars)
return true; return true;
length = strlen(chars); length = strlen(chars);
*_bufferSize -= length; if (*_bufferSize <= length) {
*_bufferSize = 0;
if (*_bufferSize <= 0)
return false; return false;
}
*_bufferSize -= length;
memcpy(buffer, chars, length); memcpy(buffer, chars, length);
buffer += length; buffer += length;
buffer[0] = '\0'; buffer[0] = '\0';
@@ -546,11 +547,12 @@ put_char(char **_buffer, size_t *_bufferSize, char c)
{ {
char *buffer = *_buffer; char *buffer = *_buffer;
*_bufferSize -= 1; if (*_bufferSize <= 1) {
*_bufferSize = 0;
if (*_bufferSize <= 0)
return false; return false;
}
*_bufferSize -= 1;
buffer[0] = c; buffer[0] = c;
buffer[1] = '\0'; buffer[1] = '\0';
@@ -872,8 +874,7 @@ get_driver_settings_string(void *_handle, char *buffer, size_t *_bufferSize,
0, flat); 0, flat);
} }
*_bufferSize -= bufferSize; return bufferSize > 0 ? B_OK : B_BUFFER_OVERFLOW;
return bufferSize >= 0 ? B_OK : B_BUFFER_OVERFLOW;
} }