diff options
| author | Christopher R. Palmer <crpalmer@gmail.com> | 2014-09-22 14:35:54 -0400 |
|---|---|---|
| committer | Christopher R. Palmer <crpalmer@gmail.com> | 2014-09-22 20:42:25 -0400 |
| commit | 07f3fee164bd7ba14ce9b2dd3818006f07162845 (patch) | |
| tree | a01936d69e3a1ea1d1d04af8e2a3164ff4b77920 | |
| parent | fbe58079b4ac12462f1ad7a23ff745919621b8dd (diff) | |
| download | system_core-07f3fee164bd7ba14ce9b2dd3818006f07162845.zip system_core-07f3fee164bd7ba14ce9b2dd3818006f07162845.tar.gz system_core-07f3fee164bd7ba14ce9b2dd3818006f07162845.tar.bz2 | |
init: Fix memory corruption when sanitizing platform paths
This commit fixes code that incorrectly increments s when it
hits the terminator character of the string being sanitized.
This means it will randomly start trashing memory beyond the
end of the string being sanitized until it happens to hit two
NULs (\0\0) which will break it out of the loop.
Change-Id: I76553d7f183236a78a0bc7b408e92559b98f732f
| -rw-r--r-- | init/util.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/init/util.c b/init/util.c index 0f69e1c..e1a3ee3 100644 --- a/init/util.c +++ b/init/util.c @@ -329,9 +329,9 @@ void sanitize(char *s) if (!s) return; - for (; *s; s++) { + while (*s) { s += strspn(s, accept); - if (*s) *s = '_'; + if (*s) *s++ = '_'; } } |