From patchwork Mon Aug 29 23:56:01 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cheng Renquan X-Patchwork-Id: 1111322 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.4) with ESMTP id p7TNvvjO026498 for ; Mon, 29 Aug 2011 23:57:57 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754883Ab1H2X55 (ORCPT ); Mon, 29 Aug 2011 19:57:57 -0400 Received: from mail-gx0-f174.google.com ([209.85.161.174]:59561 "EHLO mail-gx0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754806Ab1H2X54 (ORCPT ); Mon, 29 Aug 2011 19:57:56 -0400 Received: by gxk21 with SMTP id 21so5245969gxk.19 for ; Mon, 29 Aug 2011 16:57:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; bh=X9Tzht1vfBY5PReTgfHvD7JX30ziVTsaiqMBH1ARtHg=; b=lZ9LvCvFVthz+CkdExe4wpWRlxT5YRmA/T9N9MAuMXUjJmnTjVAHXGZxqrtolCzB0n AkgLa9cPk0QCHJ2PSKZ8bLwztrxFpTVr+NWjOWSwFjdffHbFSvMfh0961Woz9IKLcz4B Wdaf+zWvEpTWdCwBSjLqsYLa8RouUhs8kRSQw= Received: by 10.42.147.201 with SMTP id o9mr5672292icv.412.1314662275963; Mon, 29 Aug 2011 16:57:55 -0700 (PDT) Received: from localhost.localdomain ([128.107.105.172]) by mx.google.com with ESMTPS id u1sm5993373icj.4.2011.08.29.16.57.53 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 29 Aug 2011 16:57:54 -0700 (PDT) From: Cheng Renquan To: linux-kbuild@vger.kernel.org Cc: Sam Ravnborg , Michal Marek , Nir Tzachar , Randy Dunlap , c.rq541@comcast.net Subject: [PATCH 2/5] scripts/kconfig/nconf: fix memmove's length arg Date: Mon, 29 Aug 2011 16:56:01 -0700 Message-Id: <1314662164-8565-2-git-send-email-crquan@gmail.com> X-Mailer: git-send-email 1.7.6 In-Reply-To: <1314662164-8565-1-git-send-email-crquan@gmail.com> References: <1314662164-8565-1-git-send-email-crquan@gmail.com> Sender: linux-kbuild-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kbuild@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Mon, 29 Aug 2011 23:57:58 +0000 (UTC) In case KEY_BACKSPACE or KEY_DC to delete a char, it memmove only (len-cursor_position+1) bytes; the default case is to insert a char, it should also memmove only (len-cursor_position+1) bytes; the original use of (len+1) is wrong and may access following memory that doesn't belong to result, may cause SegFault in theroy; case KEY_BACKSPACE: if (cursor_position > 0) { memmove(&result[cursor_position-1], &result[cursor_position], len-cursor_position+1); cursor_position--; } break; case KEY_DC: if (cursor_position >= 0 && cursor_position < len) { memmove(&result[cursor_position], &result[cursor_position+1], len-cursor_position+1); } break; default: if ((isgraph(res) || isspace(res)) && len-2 < result_len) { /* insert the char at the proper position */ memmove(&result[cursor_position+1], &result[cursor_position], len-cursor_position+1); result[cursor_position] = res; cursor_position++; } Signed-off-by: Cheng Renquan --- scripts/kconfig/nconf.gui.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c index d3af04e..3ce2a7c 100644 --- a/scripts/kconfig/nconf.gui.c +++ b/scripts/kconfig/nconf.gui.c @@ -457,7 +457,7 @@ int dialog_inputbox(WINDOW *main_window, /* insert the char at the proper position */ memmove(&result[cursor_position+1], &result[cursor_position], - len+1); + len-cursor_position+1); result[cursor_position] = res; cursor_position++; } else {