fdo-mirrors/wayland
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wayland/wayland.git synced 2025-12-20 08:10:07 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

connection: Avoid undefined pointer arithmetic

Browse source 
Creating a pointer that is more than one element past the end of an
array is undefined behavior, even if the pointer is not dereferenced.
Avoid this undefined behavior by using `p >= end` instead of
`p + 1 > end` and `SOMETHING > end - p` instead of
`p + SOMETHING > end`.

Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
This commit is contained in:
Demi Marie Obenour 2024-07-24 21:18:40 -04:00
parent 10df74c240
commit 4273a5edc8
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/connection.c
View file

@ -928,7 +928,7 @@ wl_connection_demarshal(struct wl_connection *connection,
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
signature = get_next_argument(signature, &arg); signature = get_next_argument(signature, &arg);
if (arg.type != WL_ARG_FD && p + 1 > end) { if (arg.type != WL_ARG_FD && p >= end) {
wl_log("message too short, " wl_log("message too short, "
"object (%d), message %s(%s)\n", "object (%d), message %s(%s)\n",
closure->sender_id, message->name, closure->sender_id, message->name,
@ -1351,7 +1351,7 @@ serialize_closure(struct wl_closure *closure, uint32_t *buffer,
if (arg.type == WL_ARG_FD) if (arg.type == WL_ARG_FD)
continue; continue;
if (p + 1 > end) if (p >= end)
goto overflow; goto overflow;
switch (arg.type) { switch (arg.type) {
@ -1379,7 +1379,7 @@ serialize_closure(struct wl_closure *closure, uint32_t *buffer,
size = strlen(closure->args[i].s) + 1; size = strlen(closure->args[i].s) + 1;
*p++ = size; *p++ = size;
if (p + div_roundup(size, sizeof *p) > end) if (div_roundup(size, sizeof *p) > (uint32_t)(end - p))
goto overflow; goto overflow;
memcpy(p, closure->args[i].s, size); memcpy(p, closure->args[i].s, size);
@ -1394,7 +1394,7 @@ serialize_closure(struct wl_closure *closure, uint32_t *buffer,
size = closure->args[i].a->size; size = closure->args[i].a->size;
*p++ = size; *p++ = size;
if (p + div_roundup(size, sizeof *p) > end) if (div_roundup(size, sizeof *p) > (uint32_t)(end - p))
goto overflow; goto overflow;
if (size != 0) if (size != 0)