From 00f03f3f8561a0af69e52a4a51da3e78f8064cba Mon Sep 17 00:00:00 2001 From: zhusiyuan Date: Sat, 18 Mar 2023 17:36:34 +0800 Subject: [PATCH] Fix: heap-use-after-free in GetDevice Signed-off-by: zhusiyuan --- input/udriver/src/input_device_manager.cpp | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/input/udriver/src/input_device_manager.cpp b/input/udriver/src/input_device_manager.cpp index 445ef4e4f9..b30048cca1 100644 --- a/input/udriver/src/input_device_manager.cpp +++ b/input/udriver/src/input_device_manager.cpp @@ -584,23 +584,15 @@ int32_t InputDeviceManager::GetDevice(int32_t deviceIndex, InputDeviceInfo **dev { std::lock_guard guard(lock_); auto ret = INPUT_FAILURE; - std::shared_ptr detailInfo; if (devInfo == nullptr || deviceIndex > MAX_SUPPORT_DEVS) { HDF_LOGE("%{public}s: param is wrong", __func__); return INPUT_FAILURE; } - for (size_t i = 0; i <= inputDevList_.size(); i++) { - auto it = inputDevList_.find(deviceIndex); - if (it != inputDevList_.end()) { - detailInfo = std::make_shared(); - (void)memset_s(detailInfo.get(), sizeof(InputDeviceInfo), 0, sizeof(InputDeviceInfo)); - (void)memcpy_s(detailInfo.get(), sizeof(InputDeviceInfo), &it->second.detailInfo, sizeof(InputDeviceInfo)); - *devInfo = detailInfo.get(); - ret = INPUT_SUCCESS; - } else { - continue; - } + auto it = inputDevList_.find(deviceIndex); + if (it != inputDevList_.end()) { + (void)memcpy_s(*devInfo, sizeof(InputDeviceInfo), &it->second.detailInfo, sizeof(InputDeviceInfo)); + ret = INPUT_SUCCESS; } HDF_LOGD("%{public}s: devIndex: %{public}d ret: %{public}d", __func__, deviceIndex, ret); return ret; -- Gitee