fdo-mirrors/xorg-libx11
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/lib/libx11.git synced 2026-05-08 05:38:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix buffer overrun in parse_omit_name

Browse source 
When `num_fields == 12`, if the last character of the pattern is '-',
the `buf` array is overrun.

This error has been found by a static analysis tool. This is the report:

    Error: OVERRUN (CWE-119):
    libX11-1.8.7/modules/om/generic/omGeneric.c:691: cond_at_most:
      Checking "length > 255" implies that "length" may be up to 255 on
      the false branch.
    libX11-1.8.7/modules/om/generic/omGeneric.c:695: alias:
      Assigning: "last" = "buf + length - 1". "last" may now point to as
      high as byte 254 of "buf" (which consists of 256 bytes).
    libX11-1.8.7/modules/om/generic/omGeneric.c:718: ptr_incr:
      Incrementing "last". "last" may now point to as high as byte 255
      of "buf" (which consists of 256 bytes).
    libX11-1.8.7/modules/om/generic/omGeneric.c:720: ptr_incr:
      Incrementing "last". "last" may now point to as high as byte 256
      of "buf" (which consists of 256 bytes).
    libX11-1.8.7/modules/om/generic/omGeneric.c:720: overrun-local:
      Overrunning array of 256 bytes at byte offset 256 by
      dereferencing pointer "++last".
    #  718|               *++last = '*';
    #  719|
    #  720|->         *++last = '-';
    #  721|           break;
    #  722|       case 13:

Signed-off-by: José Expósito <jexposit@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
This commit is contained in:
José Expósito 2024-04-30 18:21:08 +02:00 • committed by Marge Bot
parent f67a87dad4
commit 97fb5bda3d
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/om/generic/omGeneric.c
View file

@ -688,7 +688,7 @@ parse_omit_name(
length = strlen (pattern);
if (length > XLFD_MAX_LEN)
if (length > XLFD_MAX_LEN - 1)
return -1;
strcpy(buf, pattern);