1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

XCB: fix a possible array overflow leading to a crash

Browse Source 
The QClipboard::Mode returned from modeForAtom should be checked
everywhere because values greater than Selection (i.e. FindBuffer)
aren't supported on X and should mean error conditions.

The lack of such a check did an out-of-bounds array access, which
could lead to a crash.

Change-Id: I70f70b5f713ab2f892e258d4df2f7afeb434f0c1
Reviewed-by: Uli Schlachter <psychon@znc.in>
Reviewed-by: Gatis Paeglis <gatis.paeglis@digia.com>
This commit is contained in:
Giuseppe D'Angelo 2014-09-20 20:12:38 +02:00
parent ebdd56c5bd
commit 772b799a83
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/plugins/platforms/xcb/qxcbclipboard.cpp
View File

@ -738,6 +738,9 @@ void QXcbClipboard::handleSelectionRequest(xcb_selection_request_event_t *req)
void QXcbClipboard::handleXFixesSelectionRequest(xcb_xfixes_selection_notify_event_t *event) void QXcbClipboard::handleXFixesSelectionRequest(xcb_xfixes_selection_notify_event_t *event)
{ {
QClipboard::Mode mode = modeForAtom(event->selection); QClipboard::Mode mode = modeForAtom(event->selection);
if (mode > QClipboard::Selection)
return;
// here we care only about the xfixes events that come from non Qt processes // here we care only about the xfixes events that come from non Qt processes
if (event->owner != XCB_NONE && event->owner != owner()) { if (event->owner != XCB_NONE && event->owner != owner()) {
if (!m_xClipboard[mode]) { if (!m_xClipboard[mode]) {