From 187a6ec5483e2102568a904cc091e3eba5a00187 Mon Sep 17 00:00:00 2001
From: Christopher Ferris <cferris@google.com>
Date: Fri, 8 Oct 2021 12:05:31 -0700
Subject: Do not write past end of inotify event structure.

Bug: 202159709

Test: None yet.
Change-Id: If80ed957aaa93c03a97b57e818e7783fa6e38242
(cherry picked from commit ce87c786116557e89f9da95f550d6816aeaca67e)
---
 minui/events.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/minui/events.cpp b/minui/events.cpp
index 87f811225..863ac7474 100644
--- a/minui/events.cpp
+++ b/minui/events.cpp
@@ -29,7 +29,9 @@
 
 #include <functional>
 #include <memory>
+#include <string>
 
+#include <android-base/strings.h>
 #include <android-base/unique_fd.h>
 
 #include "minui/minui.h"
@@ -118,12 +120,12 @@ static int inotify_cb(int fd, __unused uint32_t epevents) {
     }
     offset += sizeof(inotify_event) + pevent->len;
 
-    pevent->name[pevent->len] = '\0';
-    if (strncmp(pevent->name, "event", 5)) {
+    std::string event_name(pevent->name, pevent->len);
+    if (!android::base::StartsWith(event_name, "event")) {
       continue;
     }
 
-    android::base::unique_fd dfd(openat(dirfd(dir.get()), pevent->name, O_RDONLY));
+    android::base::unique_fd dfd(openat(dirfd(dir.get()), event_name.c_str(), O_RDONLY));
     if (dfd == -1) {
       break;
     }
-- 
cgit v1.2.3