diff options
| author | Tobias Stoeckmann <tobias@stoeckmann.org> | 2024-09-12 20:36:47 +0200 |
|---|---|---|
| committer | Simon Ser <contact@emersion.fr> | 2025-06-08 16:16:09 +0000 |
| commit | 1bee7aa4a7d6590f882a61a29da16316ba27c600 (patch) | |
| tree | 79b2361dc0d7fb07f38d8fde85eecb575c3bb078 /cursor/xcursor.c | |
| parent | client: fix conversion specifier in the discarded event log message (diff) | |
| download | wayland-1bee7aa4a7d6590f882a61a29da16316ba27c600.tar wayland-1bee7aa4a7d6590f882a61a29da16316ba27c600.tar.gz wayland-1bee7aa4a7d6590f882a61a29da16316ba27c600.tar.bz2 wayland-1bee7aa4a7d6590f882a61a29da16316ba27c600.tar.lz wayland-1bee7aa4a7d6590f882a61a29da16316ba27c600.tar.xz wayland-1bee7aa4a7d6590f882a61a29da16316ba27c600.tar.zst wayland-1bee7aa4a7d6590f882a61a29da16316ba27c600.zip | |
cursor: Fix undefined behavior with huge names
If an index.theme contains a theme name which gets close to INT_MAX,
then creation of full path can lead to a signed integer overflow,
which is undefined behavior.
Fix this by turning one of the values to size_t. Easy solution for a
probably never occurring issue.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Diffstat (limited to 'cursor/xcursor.c')
| -rw-r--r-- | cursor/xcursor.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/cursor/xcursor.c b/cursor/xcursor.c index 2b6c47d..b852a1f 100644 --- a/cursor/xcursor.c +++ b/cursor/xcursor.c @@ -571,7 +571,7 @@ xcursor_build_theme_dir(const char *dir, const char *theme) * add space for any needed directory separators, one per component, * and one for the trailing null */ - full_size = 1 + homelen + 1 + dirlen + 1 + themelen + 1; + full_size = (size_t) 1 + homelen + 1 + dirlen + 1 + themelen + 1; full = malloc(full_size); if (!full) return NULL; |