XCB: fix a possible array overflow leading to a crash

The QClipboard::Mode returned from modeForAtom should be checked
everywhere because values greater than Selection (i.e. FindBuffer)
aren't supported on X and should mean error conditions.

The lack of such a check did an out-of-bounds array access, which
could lead to a crash.

Change-Id: I70f70b5f713ab2f892e258d4df2f7afeb434f0c1
Reviewed-by: Uli Schlachter <psychon@znc.in>
Reviewed-by: Gatis Paeglis <gatis.paeglis@digia.com>
This commit is contained in:
Giuseppe D'Angelo 2014-09-20 20:12:38 +02:00
parent ebdd56c5bd
commit 772b799a83

View File

@ -738,6 +738,9 @@ void QXcbClipboard::handleSelectionRequest(xcb_selection_request_event_t *req)
void QXcbClipboard::handleXFixesSelectionRequest(xcb_xfixes_selection_notify_event_t *event)
{
QClipboard::Mode mode = modeForAtom(event->selection);
if (mode > QClipboard::Selection)
return;
// here we care only about the xfixes events that come from non Qt processes
if (event->owner != XCB_NONE && event->owner != owner()) {
if (!m_xClipboard[mode]) {