mirrors/wayland
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wayland/wayland.git synced 2025-10-31 22:25:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

cursor: Gracefully handle huge cursor files

Browse source 
If cursor files require more than INT_MAX bytes, it is possible to
trigger out of boundary writes.

Since these sizes are most likely not desired anyway, gracefully
handle these situations like out of memory errors.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
This commit is contained in:
Tobias Stoeckmann 2024-09-12 22:05:52 +02:00 • committed by Simon Ser
parent ce0ac4f29e
commit 5c2f31d8d6
1 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
cursor/wayland-cursor.c
View file

@ -27,6 +27,7 @@
#include "xcursor.h" #include "xcursor.h"
#include "wayland-cursor.h" #include "wayland-cursor.h"
#include "wayland-client.h" #include "wayland-client.h"
#include <limits.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <stdint.h> #include <stdint.h>
@ -284,7 +285,8 @@ wl_cursor_create_from_xcursor_images(struct xcursor_images *images,
{ {
struct cursor *cursor; struct cursor *cursor;
struct cursor_image *image; struct cursor_image *image;
int i, size; size_t size;
int i;
cursor = malloc(sizeof *cursor); cursor = malloc(sizeof *cursor);
if (!cursor) if (!cursor)
@ -314,7 +316,12 @@ wl_cursor_create_from_xcursor_images(struct xcursor_images *images,
image->image.hotspot_y = images->images[i]->yhot; image->image.hotspot_y = images->images[i]->yhot;
image->image.delay = images->images[i]->delay; image->image.delay = images->images[i]->delay;
size = image->image.width * image->image.height * 4; size = (size_t) image->image.width * image->image.height * 4;
if (size > INT_MAX) {
free(image);
break;
}
image->offset = shm_pool_allocate(theme->pool, size); image->offset = shm_pool_allocate(theme->pool, size);
if (image->offset < 0) { if (image->offset < 0) {
free(image); free(image);
@ -389,6 +396,9 @@ wl_cursor_theme_load(const char *name, int size, struct wl_shm *shm)
if (!theme) if (!theme)
return NULL; return NULL;
if (size < 0 || (size > 0 && INT_MAX / size / 4 < size))
return NULL;
if (!name) if (!name)
name = "default"; name = "default";