mirrors/wayland
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wayland/wayland.git synced 2025-11-03 09:01:42 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

wayland-client: reject socket paths longer than 108 bytes

Browse source 
Attempting to write anything longer into the embedded char
array would create a non-null-terminated string, and all
later reads would run off the end into invalid memory.

This is a hard limitation of AF_LOCAL/AF_UNIX sockets.
This commit is contained in:
Dylan Noblesmith 2012-06-15 21:39:50 +00:00
parent 00c25a0565
commit af5f8cc200
1 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/wayland-client.c
View file

@ -305,7 +305,7 @@ connect_to_socket(struct wl_display *display, const char *name)
struct sockaddr_un addr; struct sockaddr_un addr;
socklen_t size; socklen_t size;
const char *runtime_dir; const char *runtime_dir;
size_t name_size; int name_size;
runtime_dir = getenv("XDG_RUNTIME_DIR"); runtime_dir = getenv("XDG_RUNTIME_DIR");
if (!runtime_dir) { if (!runtime_dir) {
@ -333,6 +333,18 @@ connect_to_socket(struct wl_display *display, const char *name)
snprintf(addr.sun_path, sizeof addr.sun_path, snprintf(addr.sun_path, sizeof addr.sun_path,
"%s/%s", runtime_dir, name) + 1; "%s/%s", runtime_dir, name) + 1;
assert(name_size > 0);
if (name_size > (int)sizeof addr.sun_path) {
fprintf(stderr,
"error: socket path \"%s/%s\" plus null terminator"
" exceeds 108 bytes\n", runtime_dir, name);
close(display->fd);
/* to prevent programs reporting
* "failed to add socket: Success" */
errno = ENAMETOOLONG;
return -1;
};
size = offsetof (struct sockaddr_un, sun_path) + name_size; size = offsetof (struct sockaddr_un, sun_path) + name_size;
if (connect(display->fd, (struct sockaddr *) &addr, size) < 0) { if (connect(display->fd, (struct sockaddr *) &addr, size) < 0) {