History

scripts/kconfig/nconf: fix memmove's length arg

In case KEY_BACKSPACE / KEY_DC to delete a char, it memmove only (len-cursor_position+1) bytes; the default case is to insert a char, it should also memmove exactly (len-cursor_position+1) bytes; the original use of (len+1) is wrong and may access following memory that doesn't belong to result, may cause SegFault in theory; case KEY_BACKSPACE: if (cursor_position > 0) { memmove(&result[cursor_position-1], &result[cursor_position], len-cursor_position+1); cursor_position--; } break; case KEY_DC: if (cursor_position >= 0 && cursor_position < len) { memmove(&result[cursor_position], &result[cursor_position+1], len-cursor_position+1); } break; default: if ((isgraph(res) || isspace(res)) && len-2 < result_len) { /* insert the char at the proper position */ memmove(&result[cursor_position+1], &result[cursor_position], len-cursor_position+1); result[cursor_position] = res; cursor_position++; }

Cheng Renquan committed 15 years ago

Commit cd58a901 parent 4e24dbf1 file · +1 −1Browse files

Unified · Split

scripts/kconfig/nconf.gui.c+1−1
@@ -457,7 +457,7 @@ int dialog_inputbox(WINDOW *main_window, · 456 unmodified lines
457457 /* insert the char at the proper position */
458458 memmove(&result[cursor_position+1],
459459 &result[cursor_position],
460− len+1);
460+ len-cursor_position+1);
461461 result[cursor_position] = res;
462462 cursor_position++;
463463 } else {