diff options
| author |  Dominique Martinet <asmadeus@codewreck.org> | 2018-06-30 16:49:13 +0900 |
|---|---|---|
| committer | Dominique Martinet <asmadeus@codewreck.org> | 2018-07-02 08:03:41 +0900 |
| commit | 9c8fb7d025920eacf264e290010e235452235c83 (patch) | |
| tree | 6dc5bc0fc98ec9dbf7b23c7763de08ce89acb390 | |
| parent | log_kernel: s/fclose/pclose/ (for popen'd FILE) (diff) | |
| download | sway-9c8fb7d025920eacf264e290010e235452235c83.tar.gz sway-9c8fb7d025920eacf264e290010e235452235c83.tar.zst sway-9c8fb7d025920eacf264e290010e235452235c83.zip | |
invoke_swaybar: fix message length header size
size_t/ssize_t are 8 bytes on 64bit systems, so use the proper size to
transmit that information.
This could lead to ridiculously large alloc as len is not initialized to zero
Found through static analysis
| -rw-r--r-- | sway/config/bar.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sway/config/bar.c b/sway/config/bar.c index 5a97c3cc..e790c911 100644 --- a/sway/config/bar.c +++ b/sway/config/bar.c | |||
| @@ -174,7 +174,7 @@ void invoke_swaybar(struct bar_config *bar) { | |||
| 174 | if (!command) { | 174 | if (!command) { |
| 175 | const char msg[] = "Unable to allocate swaybar command string"; | 175 | const char msg[] = "Unable to allocate swaybar command string"; |
| 176 | size_t msg_len = sizeof(msg); | 176 | size_t msg_len = sizeof(msg); |
| 177 | if (write(filedes[1], &msg_len, sizeof(int))) {}; | 177 | if (write(filedes[1], &msg_len, sizeof(size_t))) {}; |
| 178 | if (write(filedes[1], msg, msg_len)) {}; | 178 | if (write(filedes[1], msg, msg_len)) {}; |
| 179 | close(filedes[1]); | 179 | close(filedes[1]); |
| 180 | exit(1); | 180 | exit(1); |
| @@ -189,8 +189,8 @@ void invoke_swaybar(struct bar_config *bar) { | |||
| 189 | } | 189 | } |
| 190 | wlr_log(L_DEBUG, "Spawned swaybar %d", bar->pid); | 190 | wlr_log(L_DEBUG, "Spawned swaybar %d", bar->pid); |
| 191 | close(filedes[0]); | 191 | close(filedes[0]); |
| 192 | ssize_t len; | 192 | size_t len; |
| 193 | if (read(filedes[1], &len, sizeof(int)) == sizeof(int)) { | 193 | if (read(filedes[1], &len, sizeof(size_t)) == sizeof(size_t)) { |
| 194 | char *buf = malloc(len); | 194 | char *buf = malloc(len); |
| 195 | if(!buf) { | 195 | if(!buf) { |
| 196 | wlr_log(L_ERROR, "Cannot allocate error string"); | 196 | wlr_log(L_ERROR, "Cannot allocate error string"); |