udev-rules.c: parse_file() - fix possible buffer overflow

[elogind.git] / udev / udev-rules.c

diff --git a/udev/udev-rules.c b/udev/udev-rules.c
index a45a8138f52cdb2702fa9f0a9020db9f8b9ad7aa..da08bc11f69668a807e675743757da033fc76dee 100644 (file)
--- a/udev/udev-rules.c
+++ b/udev/udev-rules.c
@@ -878,7 +878,7 @@ static int get_key(struct udev *udev, char **line, char **key, enum operation_ty
        char *temp;
 
        linepos = *line;
-       if (linepos == NULL && linepos[0] == '\0')
+       if (linepos == NULL || linepos[0] == '\0')
                return -1;
 
        /* skip whitespace */
@@ -1568,7 +1568,6 @@ invalid:
 static int parse_file(struct udev_rules *rules, const char *filename, unsigned short filename_off)
 {
        FILE *f;
-       unsigned int first_token;
        char line[UTIL_LINE_SIZE];
        int line_nr = 0;
        unsigned int i;
@@ -1578,10 +1577,7 @@ static int parse_file(struct udev_rules *rules, const char *filename, unsigned s
        f = fopen(filename, "r");
        if (f == NULL)
                return -1;
-
-       first_token = rules->token_cur;
-
-       while(fgets(line, sizeof(line), f) != NULL) {
+       while (fgets(line, sizeof(line), f) != NULL) {
                char *key;
                size_t len;
 
@@ -1603,6 +1599,8 @@ static int parse_file(struct udev_rules *rules, const char *filename, unsigned s
                while (line[len-2] == '\\') {
                        if (fgets(&line[len-2], (sizeof(line)-len)+2, f) == NULL)
                                break;
+                       if (strlen(&line[len-2]) < 2)
+                               break;
                        line_nr++;
                        len = strlen(line);
                }
@@ -1616,7 +1614,7 @@ static int parse_file(struct udev_rules *rules, const char *filename, unsigned s
        fclose(f);
 
        /* link GOTOs to LABEL rules in this file to be able to fast-forward */
-       for (i = first_token+1; i < rules->token_cur; i++) {
+       for (i = rules->token_cur+1; i < rules->token_cur; i++) {
                if (rules->tokens[i].type == TK_A_GOTO) {
                        char *label = &rules->buf[rules->tokens[i].key.value_off];
                        unsigned int j;