Hi Paul_123
Thanks, I think I'll make all affected variables match the return type.
By the way, I think i may have found a potential bug in apps and appsaudit:
string cmdline, target_boot_option;
ifstream proc_cmdline("/proc/cmdline");
getline(proc_cmdline, cmdline);
proc_cmdline.close();
target_boot_option = "lst=";
int sloc = cmdline.find(target_boot_option);
if ( sloc == string::npos ) {
onbootName = "onboot.lst";
} else {
int eloc = cmdline.find(" ",sloc);
int work = eloc - (sloc + target_boot_option.length());
onbootName = cmdline.substr(sloc+target_boot_option.length(),work);
}
If I understand this correctly:
If "lst=" was found, we search for the next blank space separating boot options:
int eloc = cmdline.find(" ",sloc);
If someone placed the "lst=" option last, there is no blank space, and find returns npos.
Here we calculate the length of the file name after "lst=":
int work = eloc - (sloc + target_boot_option.length());
If the previous command returned npos , then eloc would be huge and so would work.
This copies that file name to onbootName:
onbootName = cmdline.substr(sloc+target_boot_option.length(),work);
If work contains a huge value, we now fall off the end of the array and seg fault.
Did I get that right, or did I miss something?
Does C++ do something behind the scenes I'm not aware of?