diff options
| author | Demi Marie Obenour <demi@invisiblethingslab.com> | 2024-07-24 21:20:12 -0400 |
|---|---|---|
| committer | Simon Ser <contact@emersion.fr> | 2024-08-18 17:08:56 +0000 |
| commit | 6c4a695045155583a99f3fbce7bb745f79c2e726 (patch) | |
| tree | 7522110d7bd6c3ae35e5ecb56b32323866a5cc05 | |
| parent | meson: Fix use of install_data() without specifying install_dir (diff) | |
| download | wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.gz wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.bz2 wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.lz wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.xz wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.zst wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.zip | |
connection: Reject strings containing NUL bytes
libwayland cannot construct these messages as it uses strlen() to
determine string lengths. libwayland is also guaranteed to misinterpret
these messages, since message handlers only get a pointer and no length.
Therefore, reject strings containing NUL bytes.
Also remove a redundant check from the unmarshalling code. The
zero-length case has already been checked for.
Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
| -rw-r--r-- | doc/publican/sources/Protocol.xml | 3 | ||||
| -rw-r--r-- | src/connection.c | 10 |
2 files changed, 11 insertions, 2 deletions
diff --git a/doc/publican/sources/Protocol.xml b/doc/publican/sources/Protocol.xml index 38243fa..692f17e 100644 --- a/doc/publican/sources/Protocol.xml +++ b/doc/publican/sources/Protocol.xml @@ -152,7 +152,8 @@ Starts with an unsigned 32-bit length (including null terminator), followed by the UTF-8 encoded string contents, including terminating null byte, then padding to a 32-bit boundary. A null - value is represented with a length of 0. + value is represented with a length of 0. Interior null bytes are + not permitted. </para> </listitem> </varlistentry> diff --git a/src/connection.c b/src/connection.c index e1b751a..6b28d21 100644 --- a/src/connection.c +++ b/src/connection.c @@ -975,7 +975,7 @@ wl_connection_demarshal(struct wl_connection *connection, s = (char *) p; - if (length > 0 && s[length - 1] != '\0') { + if (s[length - 1] != '\0') { wl_log("string not nul-terminated, " "message %s(%s)\n", message->name, message->signature); @@ -983,6 +983,14 @@ wl_connection_demarshal(struct wl_connection *connection, goto err; } + if (strlen(s) != length - 1) { + wl_log("string has embedded nul at offset %zu, " + "message %s(%s)\n", strlen(s), + message->name, message->signature); + errno = EINVAL; + goto err; + } + closure->args[i].s = s; p = next; break; |