Skip to content

Commit aa5ef6c

Browse files
committed
nxagent: fix stack smashing
In compext Atom has the size of XlibAtom. Therefore calling functions of Compext.c requires to use/pass XlibAtom. Same for Window/XlibWindow. ==15438==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffffcdc0 at pc 0x5555556a81b5 bp 0x7fffffffcd10 sp 0x7fffffffcd08 WRITE of size 8 at 0x7fffffffcdc0 thread T0 #0 0x5555556a81b4 in NXGetCollectedProperty nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c:4124 #1 0x5555557d0488 in nxagentCollectPropertyEvent nx-X11/programs/Xserver/hw/nxagent/Clipboard.c:1202 #2 0x555555723340 in nxagentHandleCollectPropertyEvent nx-X11/programs/Xserver/hw/nxagent/Events.c:3923 #3 0x55555571d4db in nxagentHandleProxyEvent nx-X11/programs/Xserver/hw/nxagent/Events.c:3007 ArcticaProject#4 0x55555571bb92 in nxagentHandleClientMessageEvent nx-X11/programs/Xserver/hw/nxagent/Events.c:2595 ArcticaProject#5 0x555555717dfc in nxagentDispatchEvents nx-X11/programs/Xserver/hw/nxagent/Events.c:1827 ArcticaProject#6 0x555555750813 in nxagentBlockHandler nx-X11/programs/Xserver/hw/nxagent/Handlers.c:437 ArcticaProject#7 0x5555556c1b5d in BlockHandler nx-X11/programs/Xserver/dix/dixutils.c:403 ArcticaProject#8 0x5555556d47ff in WaitForSomething nx-X11/programs/Xserver/os/WaitFor.c:232 ArcticaProject#9 0x555555665b22 in Dispatch nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c:365 ArcticaProject#10 0x5555555ed760 in main nx-X11/programs/Xserver/dix/main.c:350 ArcticaProject#11 0x7ffff604909a in __libc_start_main ../csu/libc-start.c:308 ArcticaProject#12 0x5555555edc09 in _start (nx-X11/programs/Xserver/nxagent+0x99c09) Address 0x7fffffffcdc0 is located in stack of thread T0 at offset 32 in frame #0 0x5555557d0324 in nxagentCollectPropertyEvent nx-X11/programs/Xserver/hw/nxagent/Clipboard.c:1190 This frame has 5 object(s): [32, 36) 'atomReturnType' <== Memory access at offset 32 partially overflows this variable [96, 100) 'resultFormat' [160, 168) 'ulReturnItems' [224, 232) 'ulReturnBytesLeft' [288, 296) 'pszReturnData' HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c:4124 in NXGetCollectedProperty ...
1 parent 67330d9 commit aa5ef6c

File tree

4 files changed

+22
-4
lines changed

4 files changed

+22
-4
lines changed

nx-X11/programs/Xserver/hw/nxagent/Clipboard.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1188,7 +1188,7 @@ static void transferSelection(int resource)
11881188

11891189
void nxagentCollectPropertyEvent(int resource)
11901190
{
1191-
Atom atomReturnType;
1191+
XlibAtom atomReturnType;
11921192
int resultFormat;
11931193
unsigned long ulReturnItems;
11941194
unsigned long ulReturnBytesLeft;

nx-X11/programs/Xserver/hw/nxagent/Events.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -3924,7 +3924,7 @@ void nxagentHandleCollectPropertyEvent(XEvent *X)
39243924
}
39253925
else
39263926
{
3927-
Atom atomReturnType;
3927+
XlibAtom atomReturnType;
39283928
int resultFormat;
39293929
unsigned long ulReturnItems;
39303930
unsigned long ulReturnBytesLeft;
@@ -3940,8 +3940,8 @@ void nxagentHandleCollectPropertyEvent(XEvent *X)
39403940

39413941
if (result == True)
39423942
{
3943-
Window window = nxagentPropertyRequests[resource].window;
3944-
Atom property = nxagentPropertyRequests[resource].property;
3943+
XlibWindow window = nxagentPropertyRequests[resource].window;
3944+
XlibAtom property = nxagentPropertyRequests[resource].property;
39453945

39463946
nxagentImportProperty(window, property, atomReturnType, resultFormat,
39473947
ulReturnItems, ulReturnBytesLeft, pszReturnData);

nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c

+6
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@
2323
/* */
2424
/**************************************************************************/
2525

26+
/*
27+
* let the types be the Xlib types by undefining _XSERVER64. This
28+
* means, when calling the functions of this file from nxagent (where
29+
* Agent.h has been included) you need to use/provide XlibAtom and
30+
* XlibWindow instead of Atom and Window
31+
*/
2632
#undef _XSERVER64
2733

2834
#include <sys/socket.h>

nx-X11/programs/Xserver/hw/nxagent/compext/Compext.h

+12
Original file line numberDiff line numberDiff line change
@@ -827,19 +827,31 @@ extern int NXCollectProperty(
827827
Display* /* display */,
828828
unsigned int /* resource */,
829829
Window /* window */,
830+
#ifdef XlibAtom
831+
XlibAtom /* property */,
832+
#else
830833
Atom /* property */,
834+
#endif
831835
long /* long_offset */,
832836
long /* long_length */,
833837
Bool /* delete */,
838+
#ifdef XlibAtom
839+
XlibAtom /* req_type */
840+
#else
834841
Atom /* req_type */
835842
#endif
843+
#endif
836844
);
837845

838846
extern int NXGetCollectedProperty(
839847
#if NeedFunctionPrototypes
840848
Display* /* display */,
841849
unsigned int /* resource */,
850+
#ifdef XlibAtom
851+
XlibAtom* /* actual_type_return */,
852+
#else
842853
Atom* /* actual_type_return */,
854+
#endif
843855
int* /* actual_format_return */,
844856
unsigned long* /* nitems_return */,
845857
unsigned long* /* bytes_after_return */,

0 commit comments

Comments
 (0)