sway: prevent endless loop with broken clients

The server loops endlessly in following scenarios:
- client sends less bytes than IPC header requires
- client sends less bytes than defined by payload size
- client sends more payload data than buffered by operating system

This happens because the server relies on the buffering in sockets by
the operating system. The server only retrieves bytes from buffer when
enough bytes are available. To prevent this, store data in heap.

Also check supplied payload length before working with that value.

Proof of Concept client in Python (you will notice that sway process
consumes a lot of CPU while the client is running):
```
import os
import socket

swaysock=os.environ['SWAYSOCK']
client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
client.connect(swaysock)
client.send(b'\x69\x33\x2D\x69\x70\x63\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x00')
input('Press enter to quit.')
```
This commit is contained in:
Tobias Stoeckmann 2021-05-07 20:20:31 +02:00
parent edcdb5552d
commit 06ab0d166a
2 changed files with 85 additions and 69 deletions

View file

@ -3,6 +3,9 @@
#define event_mask(ev) (1 << (ev & 0x7F))
// maximum size of payload is 4 MB
#define IPC_MAX_SIZE 4e6
enum ipc_command_type {
// i3 command types - see i3's I3_REPLY_TYPE constants
IPC_COMMAND = 0,