mirrors/wayland
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wayland/wayland.git synced 2025-10-31 22:25:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

connection: Handle non-nullable strings in wl_connection_demarshal

Browse source 
Currently a null string passed into a non-nullable argument of a message
will decode succesfully, probably resulting in the handler function
crashing. Instead treat it the same way we do non-nullable objects and ids.

Signed-off-by: Fergus Dall <sidereal@google.com>
This commit is contained in:
Fergus Dall 2021-06-22 19:31:26 +10:00
parent 4f53613e70
commit ccc9612e82
2 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/connection.c
View file

@ -749,6 +749,13 @@ wl_connection_demarshal(struct wl_connection *connection,
case 's': case 's':
length = *p++; length = *p++;
if (length == 0 && !arg.nullable) {
wl_log("NULL string received on non-nullable "
"type, message %s(%s)\n", message->name,
message->signature);
errno = EINVAL;
goto err;
}
if (length == 0) { if (length == 0) {
closure->args[i].s = NULL; closure->args[i].s = NULL;
break; break;

18
tests/connection-test.c
View file

@ -553,6 +553,24 @@ expected_fail_demarshal(struct marshal_data *data, const char *format,
assert(errno == expected_error); assert(errno == expected_error);
} }
TEST(connection_demarshal_null_strings)
{
struct marshal_data data;
uint32_t msg[3];
setup_marshal_data(&data);
data.value.s = NULL;
msg[0] = 400200; /* object id */
msg[1] = 12 << 16; /* size = 12, opcode = 0 */
msg[2] = 0; /* string length = 0 */
demarshal(&data, "?s", msg, (void *) validate_demarshal_s);
expected_fail_demarshal(&data, "s", msg, EINVAL);
release_marshal_data(&data);
}
/* These tests are verifying that the demarshaling code will gracefully handle /* These tests are verifying that the demarshaling code will gracefully handle
* clients lying about string and array lengths and giving values near * clients lying about string and array lengths and giving values near
* UINT32_MAX. Before fixes f7fdface and f5b9e3b9 this test would crash on * UINT32_MAX. Before fixes f7fdface and f5b9e3b9 this test would crash on