mirror of
https://github.com/swaywm/sway.git
synced 2026-04-22 06:46:27 -04:00
common: handle invalid IPC messages
The size of IPC data is stored in an unsigned 32 bit data type within
the IPC message header. In order to terminate the received data with a
nul byte, one additional byte is allocated.
It is not checked if the transmitted size is 2^32 - 1. Adding one more
byte would overflow and lead to 0 byte allocation.
On 64 bit systems, the recv call with 2^32 - 1 does not fail instantly
but reads data from the server into unallocated memory.
Prevent override of unallocated memory by aborting communication.
Proof of Concept Python server (use 64 bit address sanitized client):
```
import os
import socket
os.remove('/tmp/sway-poc.socket')
server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
server.bind('/tmp/sway-poc.socket')
server.listen(1)
print('waiting for client')
(client, address) = server.accept()
client.send(b'\x69\x33\x2D\x69\x70\x63\xFF\xFF\xFF\xFF\x00\x00\x00\x00\xFF\xFF\xFF\xFF\xFF')
input('sent reply, press enter')
client.close()
```
This commit is contained in:
parent
7c74f01f0a
commit
edcdb5552d
5 changed files with 24 additions and 12 deletions
|
|
@ -19,7 +19,7 @@
|
|||
#include "util.h"
|
||||
|
||||
void ipc_send_workspace_command(struct swaybar *bar, const char *ws) {
|
||||
uint32_t size = strlen("workspace \"\"") + strlen(ws);
|
||||
size_t size = strlen("workspace \"\"") + strlen(ws);
|
||||
for (size_t i = 0; i < strlen(ws); ++i) {
|
||||
if (ws[i] == '"' || ws[i] == '\\') {
|
||||
++size;
|
||||
|
|
@ -341,7 +341,7 @@ bool ipc_get_workspaces(struct swaybar *bar) {
|
|||
free_workspaces(&output->workspaces);
|
||||
output->focused = false;
|
||||
}
|
||||
uint32_t len = 0;
|
||||
size_t len = 0;
|
||||
char *res = ipc_single_command(bar->ipc_socketfd,
|
||||
IPC_GET_WORKSPACES, NULL, &len);
|
||||
json_object *results = json_tokener_parse(res);
|
||||
|
|
@ -409,13 +409,13 @@ bool ipc_get_workspaces(struct swaybar *bar) {
|
|||
void ipc_execute_binding(struct swaybar *bar, struct swaybar_binding *bind) {
|
||||
sway_log(SWAY_DEBUG, "Executing binding for button %u (release=%d): `%s`",
|
||||
bind->button, bind->release, bind->command);
|
||||
uint32_t len = strlen(bind->command);
|
||||
size_t len = strlen(bind->command);
|
||||
free(ipc_single_command(bar->ipc_socketfd,
|
||||
IPC_COMMAND, bind->command, &len));
|
||||
}
|
||||
|
||||
bool ipc_initialize(struct swaybar *bar) {
|
||||
uint32_t len = strlen(bar->id);
|
||||
size_t len = strlen(bar->id);
|
||||
char *res = ipc_single_command(bar->ipc_socketfd,
|
||||
IPC_GET_BAR_CONFIG, bar->id, &len);
|
||||
if (!ipc_parse_config(bar->config, res)) {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue