mirrors/wayland
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wayland/wayland.git synced 2025-11-03 09:01:42 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

wayland-server: Verify request versions before invoking handler

Browse source 
This commit provides a layer of protection for the compositor in the form
of message version checking.  We track version information in the
wl_resource and now use this version information to verify that a request
exists in that protocol version before invoking it.  This way libwayland
won't accidentally invoke a request that does not exist and thereby cause
the compositor to crash.

Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
This commit is contained in:
Jason Ekstrand 2013-07-02 14:57:10 -04:00 • committed by Kristian Høgsberg
parent 4917a967bd
commit a09d7f0d60
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/wayland-server.c
View file

@ -211,6 +211,7 @@ wl_client_connection_data(int fd, uint32_t mask, void *data)
struct wl_closure *closure; struct wl_closure *closure;
const struct wl_message *message; const struct wl_message *message;
uint32_t p[2]; uint32_t p[2];
uint32_t resource_flags;
int opcode, size; int opcode, size;
int len; int len;
@ -247,6 +248,7 @@ wl_client_connection_data(int fd, uint32_t mask, void *data)
break; break;
resource = wl_map_lookup(&client->objects, p[0]); resource = wl_map_lookup(&client->objects, p[0]);
resource_flags = wl_map_lookup_flags(&client->objects, p[0]);
if (resource == NULL) { if (resource == NULL) {
wl_resource_post_error(client->display_resource, wl_resource_post_error(client->display_resource,
WL_DISPLAY_ERROR_INVALID_OBJECT, WL_DISPLAY_ERROR_INVALID_OBJECT,
@ -266,6 +268,19 @@ wl_client_connection_data(int fd, uint32_t mask, void *data)
} }
message = &object->interface->methods[opcode]; message = &object->interface->methods[opcode];
if (!(resource_flags & WL_MAP_ENTRY_LEGACY) &&
resource->version > 0 &&
resource->version < wl_message_get_since(message)) {
wl_resource_post_error(client->display_resource,
WL_DISPLAY_ERROR_INVALID_METHOD,
"invalid method %d, object %s@%u",
opcode,
object->interface->name,
object->id);
break;
}
closure = wl_connection_demarshal(client->connection, size, closure = wl_connection_demarshal(client->connection, size,
&client->objects, message); &client->objects, message);
len -= size; len -= size;