summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGreg Hackmann <ghackmann@google.com>2013-11-21 13:26:48 -0800
committerGreg Hackmann <ghackmann@google.com>2013-11-26 13:17:35 -0800
commitf6e009ee2650d8812942aa7f5761e86402346739 (patch)
tree18d2b248ed226e29eefff618f1d60eab39187d25
parent0914e01ed9936602006ed4a6891c5e55a42e881a (diff)
downloadcore-f6e009ee2650d8812942aa7f5761e86402346739.tar.gz
init: handle ueventd path truncation better
Log an error before discarding problematic events, and add a missing truncation check to the usb subsystem's unique codepath Change-Id: I0d05aa287ffc63b46d1752d2a7409d35dc8caca7 Signed-off-by: Greg Hackmann <ghackmann@google.com>
-rw-r--r--init/devices.c18
1 files changed, 16 insertions, 2 deletions
diff --git a/init/devices.c b/init/devices.c
index af88c5f09..2551ca83f 100644
--- a/init/devices.c
+++ b/init/devices.c
@@ -530,8 +530,11 @@ static const char *parse_device_name(struct uevent *uevent, unsigned int len)
name++;
/* too-long names would overrun our buffer */
- if(strlen(name) > len)
+ if(strlen(name) > len) {
+ ERROR("DEVPATH=%s exceeds %u-character limit on filename; ignoring event\n",
+ name, len);
return NULL;
+ }
return name;
}
@@ -576,7 +579,18 @@ static void handle_generic_device_event(struct uevent *uevent)
* see drivers/base/core.c
*/
char *p = devpath;
- snprintf(devpath, sizeof(devpath), "/dev/%s", uevent->device_name);
+ int s = snprintf(devpath, sizeof(devpath), "/dev/%s",
+ uevent->device_name);
+ if (s < 0) {
+ ERROR("failed to assemble device path (%s); ignoring event\n",
+ strerror(errno));
+ return;
+ } else if ((size_t)s >= sizeof(devpath)) {
+ ERROR("/dev/%s exceeds %u-character limit on path; ignoring event\n",
+ uevent->device_name, sizeof(devpath));
+ return;
+ }
+
/* skip leading /dev/ */
p += 5;
/* build directories */