Fixes unsafe pointer madness.

`func uiEvt(e termbox.Event) Event` used to change the type of termbox.Event to Event by
using some pointer-cast magic[1], which could cause an overflow if `termbox.Event` changes
its structure.
I'd rather just have `type Event termbox.Event` but that would break backwards compatibility.

Warning: A buffer overflow could cause a serious security issue but it is very unlikely that
anyone could exploit that (though not impossbible). You'd need to push a upstream update to
termbox, which would tweak termbox.Event's structure. Still, this issue should be fixed and
unsafe should never be used.

[1] it used to get the address of termbox.Event and just cast a Event pointer
This commit is contained in:
Matteo Kloiber
2015-04-15 13:35:12 +02:00
parent b3e1431d46
commit 821f8bfd95
2 changed files with 41 additions and 2 deletions

View File

@@ -9,7 +9,6 @@
package termui
import "github.com/nsf/termbox-go"
import "unsafe"
/***********************************termbox-go**************************************/
@@ -133,7 +132,19 @@ const (
// convert termbox.Event to termui.Event
func uiEvt(e termbox.Event) Event {
return *(*Event)(unsafe.Pointer(&e))
event := Event{}
event.Type = EventType(e.Type)
event.Mod = Modifier(e.Mod)
event.Key = Key(e.Key)
event.Ch = e.Ch
event.Width = e.Width
event.Height = e.Height
event.Err = e.Err
event.MouseX = e.MouseX
event.MouseY = e.MouseY
event.N = e.N
return event
}
var evtChs = make([]chan Event, 0)