mirrors/wlroots
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2026-05-25 21:37:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

xwayland/selection: stop using VLAs for MIME type atom lists

Browse source 
The size of the VLA is client-controlled and can overflow the
stack. Instead, allocate on the heap.

Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4090
This commit is contained in:
Simon Ser 2026-05-21 13:51:52 +02:00 • committed by Simon Zeni
parent c91543352a
commit cb0fa9b0a3
2 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
xwayland/selection/dnd.c
View file

@ -83,7 +83,12 @@ static void xwm_dnd_send_enter(struct wlr_xwm *xwm) {
// data and must be retrieved with the DND_TYPE_LIST property
data.data32[1] |= 1;
xcb_atom_t targets[n];
xcb_atom_t *targets = malloc(n * sizeof(targets[0]));
if (targets == NULL) {
wlr_log(WLR_ERROR, "Allocation failed");
return;
}
size_t i = 0;
char **mime_type_ptr;
wl_array_for_each(mime_type_ptr, mime_types) {
@ -99,6 +104,8 @@ static void xwm_dnd_send_enter(struct wlr_xwm *xwm) {
XCB_ATOM_ATOM,
32, // format
n, targets);
free(targets);
}
xwm_dnd_send_event(xwm, xwm->atoms[DND_ENTER], &data);

8
xwayland/selection/outgoing.c
View file

@ -336,7 +336,11 @@ static void xwm_selection_send_targets(struct wlr_xwm_selection *selection,
}
size_t n = 2 + mime_types->size / sizeof(char *);
xcb_atom_t targets[n];
xcb_atom_t *targets = malloc(n * sizeof(targets[0]));
if (targets == NULL) {
wlr_log(WLR_ERROR, "Allocation failure");
return;
}
targets[0] = xwm->atoms[TIMESTAMP];
targets[1] = xwm->atoms[TARGETS];
@ -356,6 +360,8 @@ static void xwm_selection_send_targets(struct wlr_xwm_selection *selection,
32, // format
n, targets);
free(targets);
xwm_selection_send_notify(selection->xwm, req, true);
}