From f30cb0d3b9fd2d7c51339404ddaeae53ba9b90f9 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Marek=20Beh=C3=BAn?= <marek.behun@nic.cz>
Date: Fri, 24 Sep 2021 23:06:39 +0200
Subject: [PATCH] tools: kwboot: Fix buffer overflow in kwboot_terminal()
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

The `in` variable is set to -1 in kwboot_terminal() if stdin is not a
tty. In this case we should not look whether -1 is set in fd_set, for it
can lead to a buffer overflow, which can be reproduced with
  echo "xyz" | ./tools/kwboot -t /dev/ttyUSB0

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Stefan Roese <sr@denx.de>
---
 tools/kwboot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/kwboot.c b/tools/kwboot.c
index 7feeaa45a2..e6e99849a7 100644
--- a/tools/kwboot.c
+++ b/tools/kwboot.c
@@ -552,7 +552,7 @@ kwboot_terminal(int tty)
 				break;
 		}
 
-		if (FD_ISSET(in, &rfds)) {
+		if (in >= 0 && FD_ISSET(in, &rfds)) {
 			rc = kwboot_term_pipe(in, tty, quit, &s);
 			if (rc)
 				break;
-- 
2.34.1