From ff923a8576b84f98ecb41837347a19c2679a626b Mon Sep 17 00:00:00 2001 From: Ahmad Fatoum Date: Fri, 14 Sep 2018 11:17:15 +0200 Subject: [PATCH] Fix buffer underflow when serial peer spews garbage A board I got spews garbage on hard reset. Sometimes that garbage is IAC and it leads to len here getting negative and the loop eventually underflows the buf. Detect and avoid this silently. Signed-off-by: Ahmad Fatoum --- mux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mux.c b/mux.c index 1cfb914..1741efe 100644 --- a/mux.c +++ b/mux.c @@ -211,7 +211,7 @@ char *answerback; static void write_receive_buf(const unsigned char *buf, int len) { - if (!len) + if (len <= 0) return; write(STDOUT_FILENO, buf, len); @@ -306,7 +306,7 @@ static int handle_receive_buf(struct ios_ops *ios, unsigned char *buf, int len) unsigned char *sendbuf = buf; int i; - while (len) { + while (len > 0) { switch (*buf) { case IAC: /* BUG: this is telnet specific */