pyrox.dev
lol
1Fix error handling for read from stdin in attach.c
2
3attach.c did not correctly handle a read from stdin when read returned
4an error. The code assigned the return value of read to pkt.len (an
5unsigned char) before checking the value. This prevented the error check
6from working correctly, since an unsigned integer can never be < 0.
7
8A packet with an invalid length was then sent to the master, which then
9sent 255 bytes of garbage to the program.
10
11Fix the bug in attach.c and the unchecked packet length bug in master.c.
12
13Report and initial patch by Enrico Scholz.
14
15--- a/master.c 2012/07/01 21:26:10 1.14
16+++ b/master.c 2012/07/01 21:44:34 1.15
17@@ -351,7 +351,10 @@
18
19 /* Push out data to the program. */
20 if (pkt.type == MSG_PUSH)
21- write(the_pty.fd, pkt.u.buf, pkt.len);
22+ {
23+ if (pkt.len <= sizeof(pkt.u.buf))
24+ write(the_pty.fd, pkt.u.buf, pkt.len);
25+ }
26
27 /* Attach or detach from the program. */
28 else if (pkt.type == MSG_ATTACH)
29--- a/attach.c 2012/07/01 21:26:10 1.12
30+++ b/attach.c 2012/07/01 21:44:34 1.13
31@@ -237,12 +237,16 @@
32 /* stdin activity */
33 if (n > 0 && FD_ISSET(0, &readfds))
34 {
35+ ssize_t len;
36+
37 pkt.type = MSG_PUSH;
38 memset(pkt.u.buf, 0, sizeof(pkt.u.buf));
39- pkt.len = read(0, pkt.u.buf, sizeof(pkt.u.buf));
40+ len = read(0, pkt.u.buf, sizeof(pkt.u.buf));
41
42- if (pkt.len <= 0)
43+ if (len <= 0)
44 exit(1);
45+
46+ pkt.len = len;
47 process_kbd(s, &pkt);
48 n--;
49 }