summaryrefslogtreecommitdiffstats
path: root/scripts/kconfig
diff options
context:
space:
mode:
authorCheng Renquan <crquan@gmail.com>2011-09-01 10:52:19 -0700
committerMichal Marek <mmarek@suse.cz>2011-09-09 14:40:08 +0200
commitcd58a90fa6ff2ec86bcc9e399acfd6dcc97268b3 (patch)
treee941beaeb57e7b3158bb6f5c8cb6b6f72fa121e8 /scripts/kconfig
parent4e24dbfc26f8b8285c9ed2f92ffddf4eb8ab960a (diff)
downloadlinux-cd58a90fa6ff2ec86bcc9e399acfd6dcc97268b3.tar.bz2
scripts/kconfig/nconf: fix memmove's length arg
In case KEY_BACKSPACE / KEY_DC to delete a char, it memmove only (len-cursor_position+1) bytes; the default case is to insert a char, it should also memmove exactly (len-cursor_position+1) bytes; the original use of (len+1) is wrong and may access following memory that doesn't belong to result, may cause SegFault in theory; case KEY_BACKSPACE: if (cursor_position > 0) { memmove(&result[cursor_position-1], &result[cursor_position], len-cursor_position+1); cursor_position--; } break; case KEY_DC: if (cursor_position >= 0 && cursor_position < len) { memmove(&result[cursor_position], &result[cursor_position+1], len-cursor_position+1); } break; default: if ((isgraph(res) || isspace(res)) && len-2 < result_len) { /* insert the char at the proper position */ memmove(&result[cursor_position+1], &result[cursor_position], len-cursor_position+1); result[cursor_position] = res; cursor_position++; } Signed-off-by: Cheng Renquan <crquan@gmail.com> Acked-by: Nir Tzachar <nir.tzachar@gmail.com>
Diffstat (limited to 'scripts/kconfig')
-rw-r--r--scripts/kconfig/nconf.gui.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
index d3af04e95288..3ce2a7c0bda6 100644
--- a/scripts/kconfig/nconf.gui.c
+++ b/scripts/kconfig/nconf.gui.c
@@ -457,7 +457,7 @@ int dialog_inputbox(WINDOW *main_window,
/* insert the char at the proper position */
memmove(&result[cursor_position+1],
&result[cursor_position],
- len+1);
+ len-cursor_position+1);
result[cursor_position] = res;
cursor_position++;
} else {