Attachment 1286 Details for Bug 1818 – [FIXED_X11R68x] Patch for 6.8.2 to fix this and the original xmodmap overflow

[patch] [FIXED_X11R68x] Patch for 6.8.2 to fix this and the original xmodmap overflow

xorg-x11-6.8.1-xmodmap-overflows.patch (text/plain), 3.47 KB, created by Kristian Høgsberg on 2004-11-11 07:42:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kristian Høgsberg

Created: 2004-11-11 07:42:14 UTC

Size: 3.47 KB

patch

obsolete

>Patch to fix bugs:
>
>      https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=83720
>      https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=103161
>
>Patch edited to fix off-by-one error:
>
>      https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138743
>      aka https://freedesktop.org/bugzilla/show_bug.cgi?id=1818
>
>Index: xc/programs/xmodmap/pf.c
>===================================================================
>RCS file: /cvs/xorg/xc/programs/xmodmap/pf.c,v
>retrieving revision 1.1.1.1
>diff -u -p -u -r1.1.1.1 pf.c
>--- xc/programs/xmodmap/pf.c	14 Nov 2003 16:49:23 -0000	1.1.1.1
>+++ xc/programs/xmodmap/pf.c	15 Oct 2004 00:19:35 -0000
>@@ -87,8 +87,12 @@ void process_line (buffer)
>     int i;
>     char *cp;
> 
>-    len = strlen (buffer);
>-
>+    /* copy buffer since it may point to unwritable date */
>+    len = strlen(buffer);
>+    cp = chk_malloc(len + 1);
>+    strcpy(cp, buffer);
>+    buffer = cp;
>+    
>     for (i = 0; i < len; i++) {		/* look for blank lines */
> 	register char c = buffer[i];
> 	if (!(isspace(c) || c == '\n')) break;
>Index: xc/programs/xmodmap/xmodmap.c
>===================================================================
>RCS file: /cvs/xorg/xc/programs/xmodmap/xmodmap.c,v
>retrieving revision 1.2
>diff -u -p -u -r1.2 xmodmap.c
>--- xc/programs/xmodmap/xmodmap.c	23 Apr 2004 19:54:59 -0000	1.2
>+++ xc/programs/xmodmap/xmodmap.c	15 Oct 2004 00:19:35 -0000
>@@ -51,6 +51,16 @@ Exit(int status)
>     exit (status);
> }
> 
>+void *
>+chk_malloc(size_t n_bytes)
>+{
>+    void *buf = malloc(n_bytes);
>+    if (!buf) {
>+	fprintf(stderr, "%s: Could not allocate %d bytes\n", ProgramName, (int)n_bytes);
>+	Exit(-1);
>+    }
>+    return buf;
>+}
> 
> static char *help_message[] = {
> "\nwhere options include:",
>@@ -244,9 +254,10 @@ main(int argc, char *argv[])
> 	      case 's':
> 	      case 'l':
> 	      case 'c': {
>-		  char cmd[80];		/* big enough to hold line */
>+		  char *cmd;
> 		  didAnything = True;
> 		  if (++i >= argc) usage ();
>+		  cmd = chk_malloc (strlen ("remove control = ") + strlen (argv[i]) + 1);
> 		  (void) sprintf (cmd, "remove %s = %s",
> 				  ((arg[1] == 's') ? "shift" :
> 				   ((arg[1] == 'l') ? "lock" :
>@@ -265,10 +276,10 @@ main(int argc, char *argv[])
> 	      case '3':
> 	      case '4':
> 	      case '5': {
>-		  char cmd[80];		/* big enough to hold line */
>+		  char *cmd;
> 		  didAnything = True;
> 		  if (++i >= argc) usage ();
>-
>+		  cmd = chk_malloc (strlen ("add modX = ") + strlen (argv[i]) + 1);
> 		  (void) sprintf (cmd, "add mod%c = %s", arg[1], argv[i]);
> 		  process_line (cmd);
> 		  continue;
>@@ -281,9 +292,10 @@ main(int argc, char *argv[])
> 	      case 's':
> 	      case 'l':
> 	      case 'c': {
>-		  char cmd[80];		/* big enough to hold line */
>+		  char *cmd;
> 		  didAnything = True;
> 		  if (++i >= argc) usage ();
>+		  cmd = chk_malloc (strlen ("add control = ") + strlen (argv[i]) + 1);
> 		  (void) sprintf (cmd, "add %s = %s",
> 				  ((arg[1] == 's') ? "shift" :
> 				   ((arg[1] == 'l') ? "lock" :
>Index: xc/programs/xmodmap/xmodmap.h
>===================================================================
>RCS file: /cvs/xorg/xc/programs/xmodmap/xmodmap.h,v
>retrieving revision 1.2
>diff -u -p -u -r1.2 xmodmap.h
>--- xc/programs/xmodmap/xmodmap.h	23 Apr 2004 19:54:59 -0000	1.2
>+++ xc/programs/xmodmap/xmodmap.h	15 Oct 2004 00:19:35 -0000
>@@ -56,3 +56,5 @@ extern void PrintModifierMapping(XModifi
> extern void PrintKeyTable(Bool exprs, FILE *fp);
> extern void PrintPointerMap(FILE *fp);
> extern int SetPointerMap(unsigned char *map, int n);
>+
>+extern void *chk_malloc(size_t n_bytes);

Flags:

roland.mainz: 6.8-branch+

Actions: View | Splinter Review

Attachments on bug 1818: 1286

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.