andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

modesetting: Fix potential buffer overflow

Browse Source 
If one misconfigures a ZaphodHeads value (more than 20 characters
without a delimiter), we get an overflow of our buffer.  Use
xstrtokenize() instead of writing/fixing our own tokenizer.

Signed-off-by: Daniel Martin <consume.noise@gmail.com>
Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
This commit is contained in:
Daniel Martin 2017-10-27 16:11:53 +02:00 committed by Adam Jackson
parent 2230e6c8af
commit 04a305121f
2 changed files with 14 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
hw/xfree86/drivers/modesetting/drmmode_display.c
View File

@ -57,34 +57,22 @@ static PixmapPtr drmmode_create_pixmap_header(ScreenPtr pScreen, int width, int
static Bool
drmmode_zaphod_string_matches(ScrnInfoPtr scrn, const char *s, char *output_name)
{
int i = 0;
char s1[20];
char **token = xstrtokenize(s, ", \t\n\r");
Bool ret = FALSE;
do {
switch(*s) {
case ',':
s1[i] = '\0';
i = 0;
if (strcmp(s1, output_name) == 0)
return TRUE;
break;
case ' ':
case '\t':
case '\n':
case '\r':
break;
default:
s1[i] = *s;
i++;
break;
}
} while(*s++);
if (!token)
return FALSE;
s1[i] = '\0';
if (strcmp(s1, output_name) == 0)
return TRUE;
for (int i = 0; token[i]; i++) {
if (strcmp(token[i], output_name) == 0)
ret = TRUE;
return FALSE;
free(token[i]);
}
free(token);
return ret;
}
int

2
include/misc.h
View File

@ -233,7 +233,7 @@ padding_for_int32(const int bytes)
}
extern char **xstrtokenize(const char *str, const char *separators);
extern _X_EXPORT char **xstrtokenize(const char *str, const char *separators);
extern void FormatInt64(int64_t num, char *string);
extern void FormatUInt64(uint64_t num, char *string);
extern void FormatUInt64Hex(uint64_t num, char *string);