fdo-mirrors/xorg-libx11
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/lib/libx11.git synced 2026-05-03 06:38:00 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix use of uninitialized variable in _XimExtension

Browse source 
`_XimRead()` is being called with `reply` as target buffer instead of
using `preply`, accessing uninitialized memory a few lines later.

This error has been found by a static analysis tool. This is the report:

    Error: UNINIT (CWE-457):
    libX11-1.8.7/modules/im/ximcp/imExten.c:468: alloc_fn:
      Calling "malloc" which returns uninitialized memory.
    libX11-1.8.7/modules/im/ximcp/imExten.c:468: assign:
      Assigning: "preply" = "malloc((size_t)((buf_size == 0) ? 1 : buf_size))",
      which points to uninitialized data.
    libX11-1.8.7/modules/im/ximcp/imExten.c:479: uninit_use:
      Using uninitialized value "*((CARD8 *)preply)".
    #  477|           return False;
    #  478|       buf_s = (CARD16 *)((char *)preply + XIM_HEADER_SIZE);
    #  479|->     if (*((CARD8 *)preply) == XIM_ERROR) {
    #  480|           _XimProcError(im, 0, (XPointer)&buf_s[3]);
    #  481|               if(reply != preply)

Signed-off-by: José Expósito <jexposit@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
This commit is contained in:
José Expósito 2024-04-30 16:41:40 +02:00 • committed by Marge Bot
parent 4f5541193d
commit eaad761e24
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/im/ximcp/imExten.c
View file

@ -466,7 +466,7 @@ _XimExtension(
} else {
buf_size = len;
preply = Xmalloc(buf_size);
ret_code = _XimRead(im, &len, reply, buf_size,
ret_code = _XimRead(im, &len, preply, buf_size,
_XimQueryExtensionCheck, 0);
if(ret_code != XIM_TRUE) {
Xfree(preply);