On Tue, Jun 23, 2020 at 09:35:22PM -0400, Gaurav Singh wrote:
> Check bounds before accessing d->d_name[].
> 
> Signed-off-by: Gaurav Singh <[email protected]>
> ---
>  tools/perf/util/build-id.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
> index c076fc7fe025..8c35cbe93f10 100644
> --- a/tools/perf/util/build-id.c
> +++ b/tools/perf/util/build-id.c
> @@ -431,7 +431,7 @@ static bool lsdir_bid_tail_filter(const char *name 
> __maybe_unused,
>                                 struct dirent *d)
>  {
>       int i = 0;
> -     while (isxdigit(d->d_name[i]) && i < SBUILD_ID_SIZE - 3)
> +     while (i < SBUILD_ID_SIZE - 3 && isxdigit(d->d_name[i]))

hum, I guess it looks better, but technicaly this is not a problem right?

isxdigit will return false on zero byte which is always present in d->d_name
so it will never get out of bounds

jirka

>               i++;
>       return (i == SBUILD_ID_SIZE - 3) && (d->d_name[i] == '\0');
>  }
> -- 
> 2.17.1
> 

Reply via email to