lkml.org 
[lkml]   [2011]   [Sep]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH V3 2/5] scripts/kconfig/nconf: fix memmove's length arg
Date
From: Cheng Renquan <crquan@gmail.com>

In case KEY_BACKSPACE / KEY_DC to delete a char, it memmove only
(len-cursor_position+1) bytes;
the default case is to insert a char, it should also memmove exactly
(len-cursor_position+1) bytes;

the original use of (len+1) is wrong and may access following memory
that doesn't belong to result, may cause SegFault in theory;

case KEY_BACKSPACE:
if (cursor_position > 0) {
memmove(&result[cursor_position-1],
&result[cursor_position],
len-cursor_position+1);
cursor_position--;
}
break;
case KEY_DC:
if (cursor_position >= 0 && cursor_position < len) {
memmove(&result[cursor_position],
&result[cursor_position+1],
len-cursor_position+1);
}
break;
default:
if ((isgraph(res) || isspace(res)) &&
len-2 < result_len) {
/* insert the char at the proper position */
memmove(&result[cursor_position+1],
&result[cursor_position],
len-cursor_position+1);
result[cursor_position] = res;
cursor_position++;
}
Signed-off-by: Cheng Renquan <crquan@gmail.com>
Acked-by: Nir Tzachar <nir.tzachar@gmail.com>
---
scripts/kconfig/nconf.gui.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
index d3af04e..3ce2a7c 100644
--- a/scripts/kconfig/nconf.gui.c
+++ b/scripts/kconfig/nconf.gui.c
@@ -457,7 +457,7 @@ int dialog_inputbox(WINDOW *main_window,
/* insert the char at the proper position */
memmove(&result[cursor_position+1],
&result[cursor_position],
- len+1);
+ len-cursor_position+1);
result[cursor_position] = res;
cursor_position++;
} else {
--
1.7.6


\
 
 \ /
  Last update: 2011-09-01 19:55    [from the cache]
©2003-2011 Jasper Spaans