configWatcher: fix inotify event reading buffer size (#11337)

Read full variable-length inotify_event structure instead of just the
fixed-size header. The previous code only read sizeof(inotify_event)
bytes, missing the trailing name field, which could cause truncated
events and undefined behavior.
This commit is contained in:
Iman Seyed 2025-08-07 12:15:28 -04:00 committed by GitHub
parent 6a1baa89b1
commit afbd879685
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -65,17 +65,34 @@ void CConfigWatcher::setOnChange(const std::function<void(const SConfigWatchEven
} }
void CConfigWatcher::onInotifyEvent() { void CConfigWatcher::onInotifyEvent() {
inotify_event ev; constexpr size_t BUFFER_SIZE = sizeof(inotify_event) + NAME_MAX + 1;
while (read(m_inotifyFd.get(), &ev, sizeof(ev)) > 0) { alignas(inotify_event) std::array<char, BUFFER_SIZE> buffer = {};
const auto WD = std::ranges::find_if(m_watches.begin(), m_watches.end(), [wd = ev.wd](const auto& e) { return e.wd == wd; }); const ssize_t bytesRead = read(m_inotifyFd.get(), buffer.data(), buffer.size());
if (bytesRead <= 0)
return;
if (WD == m_watches.end()) { for (size_t offset = 0; offset < (size_t)bytesRead;) {
Debug::log(ERR, "CConfigWatcher: got an event for wd {} which we don't have?!", ev.wd); const auto* ev = (const inotify_event*)(buffer.data() + offset);
return;
if (offset + sizeof(inotify_event) > (size_t)bytesRead) {
Debug::log(ERR, "CConfigWatcher: malformed inotify event, truncated header");
break;
} }
m_watchCallback(SConfigWatchEvent{ if (offset + sizeof(inotify_event) + ev->len > (size_t)(bytesRead)) {
.file = WD->file, Debug::log(ERR, "CConfigWatcher: malformed inotify event, truncated name field");
}); break;
}
const auto WD = std::ranges::find_if(m_watches, [wd = ev->wd](const auto& e) { return e.wd == wd; });
if (WD == m_watches.end())
Debug::log(ERR, "CConfigWatcher: got an event for wd {} which we don't have?!", ev->wd);
else
m_watchCallback(SConfigWatchEvent{
.file = WD->file,
});
offset += sizeof(inotify_event) + ev->len;
} }
} }