HIDDevice: WriteDeviceNameToFile: check lengths, close return value
Addresses security concern:
WriteDeviceNameToFile does not check buffer lengths, and uses a fixed
size of 19, though this is likely safe due to how the kernel builds the
/sys tree entries. Also fails to check return code of "close".
diff --git a/rmidevice/hiddevice.cpp b/rmidevice/hiddevice.cpp
index 3d80a3a..f6ccd58 100644
--- a/rmidevice/hiddevice.cpp
+++ b/rmidevice/hiddevice.cpp
@@ -537,7 +537,7 @@
return false;
for (;;) {
- size = write(fd, str, 19);
+ size = write(fd, str, strlen(str));
if (size < 0) {
if (errno == EINTR)
continue;
@@ -546,9 +546,8 @@
}
break;
}
- close(fd);
- return true;
+ return close(fd) == 0 && size == static_cast<ssize_t>(strlen(str));
}
void HIDDevice::RebindDriver()