Skip to content
Snippets Groups Projects
Commit 35e4bf77 authored by Rob Swindell's avatar Rob Swindell :speech_balloon:
Browse files

Fix crash in net_wm_state_is_cb when running GCC ASan-enabled build

Check size of X11 property before dereferencing as an Atom.
This fixes:
==10203==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x602000065970 at pc 0x5c5834fb8812 bp 0x7819c717c220 sp 0x7819c717c218
READ of size 8 at 0x602000065970 thread T2 (X11 Events)
    #0 0x5c5834fb8811 in net_wm_state_is_cb ../conio/x_events.c:1541

But I'm not clear when nitems_return (nir) might represent > 8-bit items or how
to detect that, so perhaps there's a *better* fix?
parent e6f6c67d
No related branches found
No related tags found
No related merge requests found
......@@ -1538,7 +1538,7 @@ net_wm_state_is_cb(bool (*cb)(Atom))
break;
}
ret = (Atom *)prop;
if (cb(*ret))
if (nir == sizeof(Atom) && cb(*ret))
is = true;
x11.XFree(prop);
if (is)
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment