frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix crash with non-nullterminated strings (reported by yvind Harboe)

This commit is contained in:
Alexander Gottwald 2005-01-06 13:24:57 +00:00
parent 591ac9c811
commit 3165236483
3 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/xwin/ChangeLog
View File

@ -1,3 +1,9 @@
2005-01-06 Alexander Gottwald <ago at freedesktop dot org>
* winmultiwindowclass.c:
* winmultiwindowwm.c:
Fix crash with non-nullterminated strings (reported by Øyvind Harboe)
2004-12-14 Alexander Gottwald <ago at freedesktop dot org> 2004-12-14 Alexander Gottwald <ago at freedesktop dot org>
* InitOutput.c: * InitOutput.c:

11
hw/xwin/winmultiwindowclass.c
View File

@ -175,7 +175,7 @@ winMultiWindowGetWindowRole (WindowPtr pWin, char **res_role)
&& prop->format == 8 && prop->format == 8
&& prop->data) && prop->data)
{ {
len_role= strlen ((char *) prop->data); len_role= prop->size;
(*res_role) = malloc (len_role + 1); (*res_role) = malloc (len_role + 1);
@ -185,7 +185,8 @@ winMultiWindowGetWindowRole (WindowPtr pWin, char **res_role)
return 0; return 0;
} }
strcpy ((*res_role), prop->data); strncpy ((*res_role), prop->data, len_role);
(*res_role)[len_role] = 0;
return 1; return 1;
} }
@ -299,7 +300,7 @@ winMultiWindowGetWMName (WindowPtr pWin, char **wmName)
&& prop->type == XA_STRING && prop->type == XA_STRING
&& prop->data) && prop->data)
{ {
len_name = strlen ((char *) prop->data); len_name = prop->size;
(*wmName) = malloc (len_name + 1); (*wmName) = malloc (len_name + 1);
@ -309,8 +310,8 @@ winMultiWindowGetWMName (WindowPtr pWin, char **wmName)
return 0; return 0;
} }
/* Add one to len_name to allow copying of trailing 0 */ strncpy ((*wmName), prop->data, len_name);
strncpy ((*wmName), prop->data, len_name+1); (*wmName)[len_name] = 0;
return 1; return 1;
} }

5
hw/xwin/winmultiwindowwm.c
View File

@ -425,7 +425,10 @@ GetWindowName (Display *pDisplay, Window iWin, char **ppName)
/* */ /* */
if (xtpName.value) if (xtpName.value)
{ {
*ppName = strdup ((char*)xtpName.value); int size = xtpName.nitems * (xtpName.format >> 3);
*ppName = malloc(size + 1);
strncpy(*ppName, xtpName.value, size);
(*ppName)[size] = 0;
XFree (xtpName.value); XFree (xtpName.value);
} }