35 lines
1 KiB
Diff
35 lines
1 KiB
Diff
Fix error handling for read from stdin in attach.c
|
|
|
|
attach.c did not correctly handle a read from stdin when read returned
|
|
an error. The code assigned the return value of read to pkt.len (an
|
|
unsigned char) before checking the value. This prevented the error check
|
|
from working correctly, since an unsigned integer can never be < 0.
|
|
|
|
A packet with an invalid length was then sent to the master, which then
|
|
sent 255 bytes of garbage to the program.
|
|
|
|
Fix the bug in attach.c and the unchecked packet length bug in master.c.
|
|
|
|
Report and initial patch by Enrico Scholz.
|
|
|
|
--- attach.c 2012/07/01 21:26:10 1.12
|
|
+++ attach.c 2012/07/01 21:44:34 1.13
|
|
@@ -237,12 +237,16 @@
|
|
/* stdin activity */
|
|
if (n > 0 && FD_ISSET(0, &readfds))
|
|
{
|
|
+ ssize_t len;
|
|
+
|
|
pkt.type = MSG_PUSH;
|
|
memset(pkt.u.buf, 0, sizeof(pkt.u.buf));
|
|
- pkt.len = read(0, pkt.u.buf, sizeof(pkt.u.buf));
|
|
+ len = read(0, pkt.u.buf, sizeof(pkt.u.buf));
|
|
|
|
- if (pkt.len <= 0)
|
|
+ if (len <= 0)
|
|
exit(1);
|
|
+
|
|
+ pkt.len = len;
|
|
process_kbd(s, &pkt);
|
|
n--;
|
|
}
|