diff options
| author | Demi Marie Obenour <demi@invisiblethingslab.com> | 2024-07-24 21:20:12 -0400 |
|---|---|---|
| committer | Simon Ser <contact@emersion.fr> | 2024-08-18 17:08:56 +0000 |
| commit | 6c4a695045155583a99f3fbce7bb745f79c2e726 (patch) | |
| tree | 7522110d7bd6c3ae35e5ecb56b32323866a5cc05 /src | |
| parent | meson: Fix use of install_data() without specifying install_dir (diff) | |
| download | wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.gz wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.bz2 wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.lz wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.xz wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.tar.zst wayland-6c4a695045155583a99f3fbce7bb745f79c2e726.zip | |
connection: Reject strings containing NUL bytes
libwayland cannot construct these messages as it uses strlen() to
determine string lengths. libwayland is also guaranteed to misinterpret
these messages, since message handlers only get a pointer and no length.
Therefore, reject strings containing NUL bytes.
Also remove a redundant check from the unmarshalling code. The
zero-length case has already been checked for.
Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/connection.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/connection.c b/src/connection.c index e1b751a..6b28d21 100644 --- a/src/connection.c +++ b/src/connection.c @@ -975,7 +975,7 @@ wl_connection_demarshal(struct wl_connection *connection, s = (char *) p; - if (length > 0 && s[length - 1] != '\0') { + if (s[length - 1] != '\0') { wl_log("string not nul-terminated, " "message %s(%s)\n", message->name, message->signature); @@ -983,6 +983,14 @@ wl_connection_demarshal(struct wl_connection *connection, goto err; } + if (strlen(s) != length - 1) { + wl_log("string has embedded nul at offset %zu, " + "message %s(%s)\n", strlen(s), + message->name, message->signature); + errno = EINVAL; + goto err; + } + closure->args[i].s = s; p = next; break; |