Skip to content

Commit d53da19

Browse files
authored
slurp_battery_info: Fix reading uninitialised memory (#531)
Fixes valgrind-found bug of the `for (walk = buf, ...` loop reading all of `buf` even though `buf` is null-terminated string (an only partly initialised char array). valgrind ./i3status -c ../etc/i3status.conf --run-once Conditional jump or move depends on uninitialised value(s) at 0x40F15A: slurp_battery_info (print_battery_info.c:164) by 0x40FA07: slurp_all_batteries (print_battery_info.c:558) by 0x40FCA6: print_battery_info (print_battery_info.c:612) by 0x409CA2: main (i3status.c:753)
1 parent ccac36f commit d53da19

File tree

2 files changed

+7
-1
lines changed

2 files changed

+7
-1
lines changed

src/general.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
}
2020

2121
/*
22-
* Reads size bytes into the destination buffer from filename.
22+
* Reads (size - 1) bytes into the destination buffer from filename,
23+
* and null-terminate it.
2324
*
2425
* On success, true is returned. Otherwise, false is returned and the content
2526
* of destination is left untouched.

src/print_battery_info.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,11 @@ static bool slurp_battery_info(battery_info_ctx_t *ctx, struct battery_info *bat
161161
}
162162

163163
for (walk = buf, last = buf; (walk - buf) < 1024; walk++) {
164+
// `*walk` (slice of `buf`) is only initialised until `null` written by `slurp()`
165+
if (*walk == '\0') {
166+
break;
167+
}
168+
164169
if (*walk == '\n') {
165170
last = walk + 1;
166171
continue;

0 commit comments

Comments
 (0)