]> granicus.if.org Git - strace/commitdiff
evdev: avoid bit vector decoding on non-successful and 0 return codes
authorEugene Syromyatnikov <evgsyr@gmail.com>
Fri, 12 Jul 2019 12:38:33 +0000 (14:38 +0200)
committerDmitry V. Levin <ldv@altlinux.org>
Sat, 13 Jul 2019 11:48:01 +0000 (11:48 +0000)
Reported by Clang.

    strace/evdev.c:157:3: note: The value 0 is assigned to 'size'
    #                size = tcp->u_rval * 8;
    #                ^~~~~~~~~~~~~~~~~~~~~~
    strace/evdev.c:158:2: warning: Declared variable-length array (VLA)
    has zero size
    #        char decoded_arg[size];
    #        ^

* evdev.c (decode_bitset_): Bail out before decoded_arg VLA definition.

evdev.c

diff --git a/evdev.c b/evdev.c
index e402d26e2b3ea84c56ec637109a85c1f88566c82..4b811cf8f157e95c32f98847f463ed7dc182f845 100644 (file)
--- a/evdev.c
+++ b/evdev.c
@@ -155,6 +155,13 @@ decode_bitset_(struct tcb *const tcp, const kernel_ulong_t arg,
                size = max_nr;
        else
                size = tcp->u_rval * 8;
+
+       if (syserror(tcp) || !size) {
+               printaddr(arg);
+
+               return RVAL_IOCTL_DECODED;
+       }
+
        char decoded_arg[size];
 
        if (umove_or_printaddr(tcp, arg, &decoded_arg))