diff mbox

[2/3] libubi: fix multiple memory corruptions

Message ID 1241862068-10596-3-git-send-email-corentincj@iksaif.net
State New, archived
Headers show

Commit Message

Corentin Chary May 9, 2009, 9:41 a.m. UTC 
The memset is obviously wrong, and valgrind tells
use there are some uninitialised bytes used after read()

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
---
 ubi-utils/src/libubi.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)
diff mbox

Patch

diff --git a/ubi-utils/src/libubi.c b/ubi-utils/src/libubi.c
index a81173d..d748a65 100644
--- a/ubi-utils/src/libubi.c
+++ b/ubi-utils/src/libubi.c
@@ -82,16 +82,17 @@  static int read_positive_ll(const char *file, long long *value)
 	if (fd == -1)
 		return -1;
 
-	rd = read(fd, buf, 50);
+	rd = read(fd, buf, sizeof(buf));
 	if (rd == -1) {
 		sys_errmsg("cannot read \"%s\"", file);
 		goto out_error;
 	}
-	if (rd == 50) {
+	if (rd == sizeof(buf)) {
 		errmsg("contents of \"%s\" is too long", file);
 		errno = EINVAL;
 		goto out_error;
 	}
+	buf[rd] = '\0';
 
 	if (sscanf(buf, "%lld\n", value) != 1) {
 		/* This must be a UBI bug */
@@ -166,6 +167,7 @@  static int read_data(const char *file, void *buf, int buf_len)
 		sys_errmsg("cannot read \"%s\"", file);
 		goto out_error;
 	}
+	((char *)buf)[rd] = '\0';
 
 	/* Make sure all data is read */
 	tmp1 = read(fd, &tmp, 1);
@@ -1244,7 +1246,7 @@  int ubi_set_property(int fd, uint8_t property, uint64_t value)
 {
 	struct ubi_set_prop_req r;
 
-	memset(&r, sizeof(struct ubi_set_prop_req), '\0');
+	memset(&r, 0, sizeof(struct ubi_set_prop_req));
 	r.property = property;
 	r.value = value;