wlr_virtual_keyboard_v1: specify size when creating keymap

xkb_keymap_new_from_string() assumes that the string is
NULL-terminated, but we don't check this so the function might
access outside the mmap'ed region. Use the safer
xkb_keymap_new_from_buffer() function.

Reported-by: Julian Orth <ju.orth@gmail.com>
Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4072
This commit is contained in:
Simon Ser 2026-04-06 15:16:12 +02:00 committed by Isaac Freund
parent 9de0ec3089
commit c393fb6bfa

View file

@ -52,7 +52,7 @@ static void virtual_keyboard_keymap(struct wl_client *client,
if (data == MAP_FAILED) {
goto fd_fail;
}
struct xkb_keymap *keymap = xkb_keymap_new_from_string(context, data,
struct xkb_keymap *keymap = xkb_keymap_new_from_buffer(context, data, size,
XKB_KEYMAP_FORMAT_TEXT_V1, XKB_KEYMAP_COMPILE_NO_FLAGS);
munmap(data, size);
if (!keymap) {