Commit cd58a90f authored by Cheng Renquan's avatar Cheng Renquan Committed by Michal Marek

scripts/kconfig/nconf: fix memmove's length arg

In case KEY_BACKSPACE / KEY_DC to delete a char, it memmove only
(len-cursor_position+1) bytes;
the default case is to insert a char, it should also memmove exactly
(len-cursor_position+1) bytes;

the original use of (len+1) is wrong and may access following memory
that doesn't belong to result, may cause SegFault in theory;

	case KEY_BACKSPACE:
		if (cursor_position > 0) {
			memmove(&result[cursor_position-1],
					&result[cursor_position],
					len-cursor_position+1);
			cursor_position--;
		}
		break;
	case KEY_DC:
		if (cursor_position >= 0 && cursor_position < len) {
			memmove(&result[cursor_position],
					&result[cursor_position+1],
					len-cursor_position+1);
		}
		break;
	default:
		if ((isgraph(res) || isspace(res)) &&
				len-2 < result_len) {
			/* insert the char at the proper position */
			memmove(&result[cursor_position+1],
					&result[cursor_position],
					len-cursor_position+1);
			result[cursor_position] = res;
			cursor_position++;
		}
Signed-off-by: default avatarCheng Renquan <crquan@gmail.com>
Acked-by: default avatarNir Tzachar <nir.tzachar@gmail.com>
parent 4e24dbfc
...@@ -457,7 +457,7 @@ int dialog_inputbox(WINDOW *main_window, ...@@ -457,7 +457,7 @@ int dialog_inputbox(WINDOW *main_window,
/* insert the char at the proper position */ /* insert the char at the proper position */
memmove(&result[cursor_position+1], memmove(&result[cursor_position+1],
&result[cursor_position], &result[cursor_position],
len+1); len-cursor_position+1);
result[cursor_position] = res; result[cursor_position] = res;
cursor_position++; cursor_position++;
} else { } else {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment