From 7f34a5c9cfa5f1424510ccef4ce6afa038eca382 Mon Sep 17 00:00:00 2001 From: Brendan Le Foll Date: Wed, 8 Jul 2015 10:29:27 +0100 Subject: [PATCH] intel_de3815.c: Add error handling to seeks and avoid reading past buffer size Signed-off-by: Brendan Le Foll --- src/x86/intel_de3815.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/src/x86/intel_de3815.c b/src/x86/intel_de3815.c index b8eb59d..5165cfd 100644 --- a/src/x86/intel_de3815.c +++ b/src/x86/intel_de3815.c @@ -126,15 +126,31 @@ mraa_intel_de3815() int i = 0; int suc = 0; for (i = 0; i < 9; i++) { + off_t size, err; char path[MAX_SIZE]; + char value[MAX_SIZE]; snprintf(path, MAX_SIZE, "/sys/class/i2c-dev/i2c-%u/name", i); fd = open(path, O_RDONLY); if (fd < 0) { break; } - off_t size = lseek(fd, 0, SEEK_END); - char value[MAX_SIZE]; - lseek(fd, 0, SEEK_SET); + size = lseek(fd, 0, SEEK_END); + if (size < 0) { + syslog(LOG_WARNING, "mraa: failed to seek i2c filename file"); + close(fd); + break; + } + err = lseek(fd, 0, SEEK_SET); + if (err < 0) { + syslog(LOG_WARNING, "mraa: failed to seek i2c filename file"); + close(fd); + break; + } + if (size >= MAX_SIZE) { + syslog(LOG_NOTICE, "mraa: i2c filename file too big, skipping"); + close(fd); + break; + } ssize_t r = read(fd, value, size); if (r > 0) { if (strcasestr(value, I2CNAME) != NULL) {