From 360dca517a8ae58f9709420b0570b4e36a1ffa3f Mon Sep 17 00:00:00 2001 From: Lubomir Rintel Date: Sat, 16 Nov 2013 14:31:03 +0100 Subject: [PATCH] connection: Error out if file descriptor was not received Otherwise the tail of fds_in buffer would just shift beyond the beginning. That confuses the actual request handler and results in a crash further on due to corrupted tail. Signed-off-by: Lubomir Rintel --- src/connection.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/connection.c b/src/connection.c index 451b93e4..1d8b61bb 100644 --- a/src/connection.c +++ b/src/connection.c @@ -744,6 +744,15 @@ wl_connection_demarshal(struct wl_connection *connection, p = next; break; case 'h': + if (connection->fds_in.tail == connection->fds_in.head) { + printf("file descriptor expected, " + "object (%d), message %s(%s)\n", + closure->sender_id, message->name, + message->signature); + errno = EINVAL; + goto err; + } + wl_buffer_copy(&connection->fds_in, &fd, sizeof fd); connection->fds_in.tail += sizeof fd; closure->args[i].h = fd;