On 11/22/2011 09:20 PM, Sascha Hauer wrote:
> On Tue, Nov 22, 2011 at 01:32:19PM +0100, Jan Weitzel wrote:
>> If read_key is feeded by STRG + KEY_LEFT you run into the while(1)
>> loop and corrupt memory through esc array.
>> Force return if index gets too high.
>>
> 
> Wow, a shortcut to crash barebox. Applied to master.
> 
> Sascha
> 
>> Signed-off-by: Jan Weitzel <j.weitzel@phytec.de>
>> ---
>>  lib/readkey.c |    2 ++
>>  1 files changed, 2 insertions(+), 0 deletions(-)
>>
>> diff --git a/lib/readkey.c b/lib/readkey.c
>> index a42d1cb..895db82 100644
>> --- a/lib/readkey.c
>> +++ b/lib/readkey.c
>> @@ -67,6 +67,8 @@ int read_key(void)
>>  				esc[i] = getc();
>>  				if (esc[i++] == '~')
>>  					break;
>> +				if (i == 5)

ARRAY_SIZE?

>> +					return -1;
>>  			}
>>  		}
>>  		esc[i] = 0;
>> -- 
>> 1.7.0.4
>>
>>
>> _______________________________________________
>> barebox mailing list
>> barebox@lists.infradead.org
>> http://lists.infradead.org/mailman/listinfo/barebox
>>
> 

Marc

-- 
Pengutronix e.K.                  | Marc Kleine-Budde           |
Industrial Linux Solutions        | Phone: +49-231-2826-924     |
Vertretung West/Dortmund          | Fax:   +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686  | http://www.pengutronix.de   |