mirrors/sway
1
0
Fork 0
mirror of https://github.com/swaywm/sway.git synced 2026-03-29 07:58:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix memory errors

Browse source 
- read_line: OOB write when a line in /proc/modules contains a
   terminating character at size position.
 - handle_view_created: Ensure that the list_t returned by criteria_for
   is free'd after use
 - ipc_event_binding_keyboard/ipc_event_binding: Properly handle
   json_object reference counting and ownership.
This commit is contained in:
Dan Robertson 2018-02-11 03:55:45 +00:00 • committed by Dan Robertson
parent a571506d0e
commit aa15629f17
No known key found for this signature in database
GPG key ID: 45C4A652C47E42A5
3 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
common/readline.c
View file

@ -36,7 +36,7 @@ char *read_line(FILE *file) {
}
string[length++] = c;
}
if (length + 1 == size) {
if (length + 1 >= size) {
char *new_string = realloc(string, length + 1);
if (!new_string) {
free(string);

2
sway/handlers.c
View file

@ -484,6 +484,8 @@ static bool handle_view_created(wlc_handle handle) {
// refocus in-between command lists
set_focused_container(newview);
}
// Make sure to free the list_t returned by criteria_for.
list_free(criteria);
swayc_t *workspace = swayc_parent_by_type(focused, C_WORKSPACE);
if (workspace && workspace->fullscreen) {
set_focused_container(workspace->fullscreen);

8
sway/ipc-server.c
View file

@ -1127,7 +1127,7 @@ static void ipc_event_binding(json_object *sb_obj) {
json_object *obj = json_object_new_object();
json_object_object_add(obj, "change", json_object_new_string("run"));
// sb_obj gets owned by the temporary json_object, too.
json_object_object_add(obj, "binding", json_object_get(sb_obj));
json_object_object_add(obj, "binding", sb_obj);
const char *json_string = json_object_to_json_string(obj);
ipc_send_event(json_string, IPC_EVENT_BINDING);
@ -1171,9 +1171,13 @@ void ipc_event_binding_keyboard(struct sway_binding *sb) {
keysym = *(uint32_t *)sb->keys->items[i];
if (xkb_keysym_get_name(keysym, buffer, 64) > 0) {
json_object *str = json_object_new_string(buffer);
json_object_array_add(symbols, str);
if (i == 0) {
// str is owned by both symbol and symbols. Make sure
// to bump the ref count.
json_object_array_add(symbols, json_object_get(str));
symbol = str;
} else {
json_object_array_add(symbols, str);
}
}
}