Validate inotify event against read() length, not buffer size
Fix ev->len validation; must check against sz read(), not total buffer
size.  Also, fix off-by-one in comparison.
@@ -803,7 +803,8 @@ static void conf_cb(uev_t *w, void *arg, int events)
{
static char ev_buf[8 *(sizeof(struct inotify_event) + NAME_MAX + 1) + 1];
struct inotify_event *ev;
- ssize_t sz, off;
+ ssize_t sz;
+ size_t off;
sz = read(w->fd, ev_buf, sizeof(ev_buf) - 1);
if (sz <= 0) {
@@ -812,14 +813,14 @@ static void conf_cb(uev_t *w, void *arg, int events)
}
ev_buf[sz] = 0;
- for (off = 0; off < sz; off += sizeof(*ev) + ev->len) {
+ for (off = 0; off < (size_t)sz; off += sizeof(*ev) + ev->len) {
struct iwatch_path *iwp;
- if (off + sizeof(*ev) >= sizeof(ev_buf))
+ if (off + sizeof(*ev) > (size_t)sz)
break;
ev = (struct inotify_event *)&ev_buf[off];
- if (off + sizeof(*ev) + ev->len >= sizeof(ev_buf))
+ if (off + sizeof(*ev) + ev->len > (size_t)sz)
break;
if (!ev->mask)
