From c393fb6bfa994e18c1f3cecd7cc306b0f6b49191 Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Mon, 6 Apr 2026 15:16:12 +0200 Subject: [PATCH] wlr_virtual_keyboard_v1: specify size when creating keymap xkb_keymap_new_from_string() assumes that the string is NULL-terminated, but we don't check this so the function might access outside the mmap'ed region. Use the safer xkb_keymap_new_from_buffer() function. Reported-by: Julian Orth Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4072 --- types/wlr_virtual_keyboard_v1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/types/wlr_virtual_keyboard_v1.c b/types/wlr_virtual_keyboard_v1.c index 011fbfec7..465b97dd3 100644 --- a/types/wlr_virtual_keyboard_v1.c +++ b/types/wlr_virtual_keyboard_v1.c @@ -52,7 +52,7 @@ static void virtual_keyboard_keymap(struct wl_client *client, if (data == MAP_FAILED) { goto fd_fail; } - struct xkb_keymap *keymap = xkb_keymap_new_from_string(context, data, + struct xkb_keymap *keymap = xkb_keymap_new_from_buffer(context, data, size, XKB_KEYMAP_FORMAT_TEXT_V1, XKB_KEYMAP_COMPILE_NO_FLAGS); munmap(data, size); if (!keymap) {