aboutsummaryrefslogtreecommitdiffstats
path: root/swaynag
diff options
context:
space:
mode:
authorLibravatar Peter Grayson <pete@jpgrayson.net>2019-03-11 22:28:35 -0400
committerLibravatar Brian Ashworth <bosrsf04@gmail.com>2019-03-11 23:00:39 -0400
commit79369681ab3d6785aabf39bd8080cd4f30507524 (patch)
tree3e9c4e05a8d81cda621b00fff8573469a1830702 /swaynag
parentcommands: allow tiled sticky containers to be moved (diff)
downloadsway-79369681ab3d6785aabf39bd8080cd4f30507524.tar.gz
sway-79369681ab3d6785aabf39bd8080cd4f30507524.tar.zst
sway-79369681ab3d6785aabf39bd8080cd4f30507524.zip
Repair swaynag crash reading message from stdin
When swaynag is run with the -l/--detailed-message option, a crash may occur if the detailed message read from stdin is large enough. E.g.: swaynag -m hello -l < ~/.config/sway/config The root cause is that the read_from_stdin() function under-allocates memory for the destination buffer which causes that buffer to be overflowed when copying line data to it with snprintf(). The repair is to allocate one more byte for the terminating null byte. N.B. although getline() returns the number of bytes read excluding a terminating null byte, the line buffer is terminated with a null byte. Thus we have a guarantee that the line buffer will be null terminated (which is important when copying with snprintf()).
Diffstat (limited to 'swaynag')
-rw-r--r--swaynag/config.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/swaynag/config.c b/swaynag/config.c
index 200611f4..fb2aa820 100644
--- a/swaynag/config.c
+++ b/swaynag/config.c
@@ -18,7 +18,7 @@ static char *read_from_stdin(void) {
18 size_t line_size = 0; 18 size_t line_size = 0;
19 ssize_t nread; 19 ssize_t nread;
20 while ((nread = getline(&line, &line_size, stdin)) != -1) { 20 while ((nread = getline(&line, &line_size, stdin)) != -1) {
21 buffer = realloc(buffer, buffer_len + nread); 21 buffer = realloc(buffer, buffer_len + nread + 1);
22 snprintf(&buffer[buffer_len], nread + 1, "%s", line); 22 snprintf(&buffer[buffer_len], nread + 1, "%s", line);
23 buffer_len += nread; 23 buffer_len += nread;
24 } 24 }