diff options
author | Cheng Renquan <crquan@gmail.com> | 2011-09-01 10:52:19 -0700 |
---|---|---|
committer | Michal Marek <mmarek@suse.cz> | 2011-09-09 14:40:08 +0200 |
commit | cd58a90fa6ff2ec86bcc9e399acfd6dcc97268b3 (patch) | |
tree | e941beaeb57e7b3158bb6f5c8cb6b6f72fa121e8 /net/socket.c | |
parent | 4e24dbfc26f8b8285c9ed2f92ffddf4eb8ab960a (diff) | |
download | talos-op-linux-cd58a90fa6ff2ec86bcc9e399acfd6dcc97268b3.tar.gz talos-op-linux-cd58a90fa6ff2ec86bcc9e399acfd6dcc97268b3.zip |
scripts/kconfig/nconf: fix memmove's length arg
In case KEY_BACKSPACE / KEY_DC to delete a char, it memmove only
(len-cursor_position+1) bytes;
the default case is to insert a char, it should also memmove exactly
(len-cursor_position+1) bytes;
the original use of (len+1) is wrong and may access following memory
that doesn't belong to result, may cause SegFault in theory;
case KEY_BACKSPACE:
if (cursor_position > 0) {
memmove(&result[cursor_position-1],
&result[cursor_position],
len-cursor_position+1);
cursor_position--;
}
break;
case KEY_DC:
if (cursor_position >= 0 && cursor_position < len) {
memmove(&result[cursor_position],
&result[cursor_position+1],
len-cursor_position+1);
}
break;
default:
if ((isgraph(res) || isspace(res)) &&
len-2 < result_len) {
/* insert the char at the proper position */
memmove(&result[cursor_position+1],
&result[cursor_position],
len-cursor_position+1);
result[cursor_position] = res;
cursor_position++;
}
Signed-off-by: Cheng Renquan <crquan@gmail.com>
Acked-by: Nir Tzachar <nir.tzachar@gmail.com>
Diffstat (limited to 'net/socket.c')
0 files changed, 0 insertions, 0 deletions