Skip to content

Commit bb6e594

Browse files
committed
slurp_battery_info: Fix reading uninitialised memory
Fixes valgrind-found bug of the `for (walk = buf, ...` loop reading all of `buf` even though `buf` is null-terminated string (an only partly initialised char array). valgrind ./i3status -c ../etc/i3status.conf --run-once Conditional jump or move depends on uninitialised value(s) at 0x40F15A: slurp_battery_info (print_battery_info.c:164) by 0x40FA07: slurp_all_batteries (print_battery_info.c:558) by 0x40FCA6: print_battery_info (print_battery_info.c:612) by 0x409CA2: main (i3status.c:753)
1 parent 200fef9 commit bb6e594

File tree

2 files changed

+6
-2
lines changed

2 files changed

+6
-2
lines changed

src/general.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
}
2020

2121
/*
22-
* Reads size bytes into the destination buffer from filename.
22+
* Reads (size - 1) bytes into the destination buffer from filename,
23+
* and null-terminate it.
2324
*
2425
* On success, true is returned. Otherwise, false is returned and the content
2526
* of destination is left untouched.

src/print_battery_info.c

+4-1
Original file line numberDiff line numberDiff line change
@@ -155,12 +155,15 @@ static bool slurp_battery_info(battery_info_ctx_t *ctx, struct battery_info *bat
155155
sprintf(batpath, path, number);
156156
INSTANCE(batpath);
157157

158-
if (!slurp(batpath, buf, sizeof(buf))) {
158+
if (!slurp(batpath, buf, sizeof(buf))) { // `slurp()` null-terminates `buf`
159159
OUTPUT_FULL_TEXT(format_down);
160160
return false;
161161
}
162162

163163
for (walk = buf, last = buf; (walk - buf) < 1024; walk++) {
164+
if (*walk == '\0') // `*walk` (slice of `buf`) is only initialised until `null` written by `slurp()`
165+
break;
166+
164167
if (*walk == '\n') {
165168
last = walk + 1;
166169
continue;

0 commit comments

Comments
 (0)