Menu

#216 lirc_client read_string not terminating buffer contents

0.9.5
closed
nobody
fixed
2016-08-03
2016-08-02
No

Example of breakage: starting lircd including the attached "yd2" remote and running,

irsend LIST yd2 ""

irsend prints an incorrect answer and then segfaults.

More to follow shortly.

1 Attachments

Discussion

  • Helen Foster

    Helen Foster - 2016-08-02

    The read_string function in lirc_client.c begins by shunting the remaining data to the start of the buffer. (If the currently-loaded data stops part-way through a line, there is no terminator included.) It then checks whether there is a line break, and loads more data if not. When reaching the incomplete line, it usually hits the null terminator left over from the previous line, and correctly decides there is no line break here. But if the incomplete line is longer than the previous line, it overwrites the null terminator, looks for a line break in the leftover garbage data, and wrong things happen.

    It should be OK just to add a null terminator after shunting the data (that code is only executed if the data will be moved at least 1 place, so there is space at the end to put it). As in the attached patch. And it took me a while to figure out what that function does, so some comments for the benefit of the next person.

    If making a commit with my name on it, please use my sourceforge email address helen-foster@users.sourceforge.net . (It might be a good idea to do that in general rather than making something up.)

     
  • Helen Foster

    Helen Foster - 2016-08-02

    Well as far as patch submissions, I've done it 2 different ways that weren't quite right, so hopefully this one is better.

     
  • Alec Leamas

    Alec Leamas - 2016-08-03

    Thanks for a really good catch + patch! Fíxed in [356b32] (master) and [4b988f] (release-0_9_4).

     

    Related

    Commit: [4b988f]
    Commit: [356b32]

  • Alec Leamas

    Alec Leamas - 2016-08-03
    • labels: --> Segmentation fault
    • status: open --> closed
    • Resolution: na --> fixed
    • Milestone: Future --> 0.9.5
     

Log in to post a comment.

MongoDB Logo MongoDB