commit 6dcadfb141c7166489a6d1a4909705a7ae3300b7
author Elliott Hughes <enh@google.com> Wed Mar 09 19:28:03 2016 -0800
committer Elliott Hughes <enh@google.com> Thu Mar 10 17:59:17 2016 -0800
tree 3c8142b901ec6543690cd9dca094c6831c8c6f3f
parent 4617edab830bd328ea7530b5d7d514b18d25919d

Fix buffer overrun in adb wait-for-device.

Bug: http://b/27444063
Change-Id: I72339d7215aae28069484b9796d71fe0c53dff96

adb/commandline.cpp

diff --git a/adb/commandline.cpp b/adb/commandline.cpp
index 30a38e3..a856672 100644
--- a/adb/commandline.cpp
+++ b/adb/commandline.cpp
@@ -1029,8 +1029,8 @@
     // TODO: when we have libc++ for Windows, use a regular expression instead.
     // wait-for-((any|local|usb)-)?(bootloader|device|recovery|sideload)
 
-    char type[20];
-    char state[20];
+    char type[20 + 1]; // sscanf's %20[...] doesn't include the NUL.
+    char state[20 + 1];
     int length = 0;
     if (sscanf(service, "wait-for-%20[a-z]-%20[a-z]%n", type, state, &length) < 2 ||
         length != static_cast<int>(strlen(service))) {