From: Sergey Vlasov <vsu@altlinux.ru>
Date: Thu, 1 Feb 2007 19:18:52 +0000 (+0100)
Subject: fix %c $string substitution
X-Git-Tag: 174~2074
X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=c0c865d4664ea10309b0ffc12b2fad19ecb98129

fix %c $string substitution

Fix udev_rules_apply_format() to give error messages for unknown
format elements and pass such elements to the output string
unmodified.

When truncating the substitution string to the length specified in the
format string, head[len] = '\0' could write outside the buffer if that
length was too large.
---

diff --git a/udev_rules.c b/udev_rules.c
index edaaa71d1..d1c3f042c 100644
--- a/udev_rules.c
+++ b/udev_rules.c
@@ -364,6 +364,8 @@ void udev_rules_apply_format(struct udevice *udev, char *string, size_t maxsize)
 						goto found;
 					}
 				}
+				head[0] = '$';
+				err("unknown format variable '%s'", head);
 			} else if (head[0] == '%') {
 				/* substitute format char */
 				if (head[1] == '\0')
@@ -385,6 +387,8 @@ void udev_rules_apply_format(struct udevice *udev, char *string, size_t maxsize)
 						goto found;
 					}
 				}
+				head[0] = '%';
+				err("unknown format char '%c'", tail[0]);
 			}
 			head++;
 		}
@@ -554,7 +558,7 @@ found:
 			break;
 		}
 		/* possibly truncate to format-char specified length */
-		if (len != -1) {
+		if (len >= 0 && len < (int)strlen(head)) {
 			head[len] = '\0';
 			dbg("truncate to %i chars, subtitution string becomes '%s'", len, head);
 		}