commit e188d18ec2c519157d4230aa29187d4060787d44
author Christopher Ferris <cferris@google.com> Tue Oct 12 14:54:09 2021 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Tue Oct 12 14:54:09 2021 +0000
tree ce9f74d8a787c028454658b3d957fa394e5f780c
parent 4f8d5e5a4d4a4587c827bd2506d3ee26013627cb
parent f837067522223d1dcaf5b7d49d206e97ff5aa53c

Do not write past end of inotify event structure. am: 187a6ec548 am: 8346be7882 am: f837067522

Original change: https://googleplex-android-review.googlesource.com/c/platform/bootable/recovery/+/16033753

Change-Id: I07faf4e3c57a6a4540990afde7852b446ddde743

minui/events.cpp

diff --git a/minui/events.cpp b/minui/events.cpp
index 87f8112..863ac74 100644
--- a/minui/events.cpp
+++ b/minui/events.cpp
@@ -29,7 +29,9 @@
 
 #include <functional>
 #include <memory>
+#include <string>
 
+#include <android-base/strings.h>
 #include <android-base/unique_fd.h>
 
 #include "minui/minui.h"
@@ -118,12 +120,12 @@
     }
     offset += sizeof(inotify_event) + pevent->len;
 
-    pevent->name[pevent->len] = '\0';
-    if (strncmp(pevent->name, "event", 5)) {
+    std::string event_name(pevent->name, pevent->len);
+    if (!android::base::StartsWith(event_name, "event")) {
       continue;
     }
 
-    android::base::unique_fd dfd(openat(dirfd(dir.get()), pevent->name, O_RDONLY));
+    android::base::unique_fd dfd(openat(dirfd(dir.get()), event_name.c_str(), O_RDONLY));
     if (dfd == -1) {
       break;
     }