From e3ae12a4185e1dc61f62bec90db12b1fc3dc906c Mon Sep 17 00:00:00 2001 From: Sascha Hauer Date: Mon, 14 Dec 2015 14:41:26 +0100 Subject: [PATCH] readline: Fix potential buffer overflow cread_add_char doesn't take the trailing '\0' into account, so adding it at the end of readline can overflow the buffer. Signed-off-by: Sascha Hauer --- lib/readline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/readline.c b/lib/readline.c index c007e10f5..4c9bb760d 100644 --- a/lib/readline.c +++ b/lib/readline.c @@ -150,7 +150,7 @@ static void cread_add_char(char ichar, int insert, unsigned long *num, /* room ??? */ if (insert || *num == *eol_num) { - if (*eol_num > len - 1) { + if (*eol_num > len - 2) { getcmd_cbeep(); return; }