mrrrgn/simple-rootkit — pull request #2 by clevcode (2014-11-12 19:16:59+00:00)
Title: Check return-value of ref_sys_read(), only search through read buffer.

If ret < 0, we should not be searching through the buffer at all. Consider, for example, the case when a kernel mode pointer is supplied as the buffer argument, which makes ref_sys_read() return -EFAULT. We should not use strstr() either, since:

- The buffer that was read may not be NUL-terminated
- The buffer that was read may have NUL-bytes within it, before the end