X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=libudev%2Flibudev-util.c;h=9a656b5a98ae5ef9cf408eb7c27b4bf5f33840ae;hb=676d294c23cf999ac7d192b058476f91242550c0;hp=dcc4a0fd16e78e9270a352f13da947c4d60d0e90;hpb=48a9b173e88738ff4eefb3519f1d27711b417c8d;p=elogind.git

diff --git a/libudev/libudev-util.c b/libudev/libudev-util.c
index dcc4a0fd1..9a656b5a9 100644
--- a/libudev/libudev-util.c
+++ b/libudev/libudev-util.c
@@ -31,7 +31,7 @@ static ssize_t get_sys_link(struct udev *udev, const char *slink, const char *sy
 
 	util_strscpyl(path, sizeof(path), syspath, "/", slink, NULL);
 	len = readlink(path, path, sizeof(path));
-	if (len < 0 || len >= (ssize_t) sizeof(path))
+	if (len <= 0 || len == (ssize_t)sizeof(path))
 		return -1;
 	path[len] = '\0';
 	pos = strrchr(path, '/');
@@ -56,13 +56,13 @@ int util_resolve_sys_link(struct udev *udev, char *syspath, size_t size)
 {
 	char link_target[UTIL_PATH_SIZE];
 
-	int len;
+	ssize_t len;
 	int i;
 	int back;
 	char *base;
 
 	len = readlink(syspath, link_target, sizeof(link_target));
-	if (len <= 0)
+	if (len <= 0 || len == (ssize_t)sizeof(link_target))
 		return -1;
 	link_target[len] = '\0';
 	dbg(udev, "path link '%s' points to '%s'\n", syspath, link_target);
@@ -448,28 +448,33 @@ int udev_util_encode_string(const char *str, char *str_enc, size_t len)
 {
 	size_t i, j;
 
-	if (str == NULL || str_enc == NULL || len == 0)
+	if (str == NULL || str_enc == NULL)
 		return -1;
 
-	str_enc[0] = '\0';
 	for (i = 0, j = 0; str[i] != '\0'; i++) {
 		int seqlen;
 
 		seqlen = utf8_encoded_valid_unichar(&str[i]);
 		if (seqlen > 1) {
+			if (len-j < (size_t)seqlen)
+				goto err;
 			memcpy(&str_enc[j], &str[i], seqlen);
 			j += seqlen;
 			i += (seqlen-1);
 		} else if (str[i] == '\\' || !is_whitelisted(str[i], NULL)) {
+			if (len-j < 4)
+				goto err;
 			sprintf(&str_enc[j], "\\x%02x", (unsigned char) str[i]);
 			j += 4;
 		} else {
+			if (len-j < 1)
+				goto err;
 			str_enc[j] = str[i];
 			j++;
 		}
-		if (j+3 >= len)
-			goto err;
 	}
+	if (len-j < 1)
+		goto err;
 	str_enc[j] = '\0';
 	return 0;
 err: