Faris/dwm
1
0
Fork 0
mirror of git://git.suckless.org/dwm synced 2026-01-18 09:48:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

dwm: Fix getatomprop regression from heap overflow fix

Browse Source 
Commit 244fa852fe27 ("dwm: Fix heap buffer overflow in getatomprop")
introduced a check for dl > 0 before dereferencing the property pointer.
However, I missed that the variable dl is passed to XGetWindowProperty
for both nitems_return and bytes_after_return parameters:

    XGetWindowProperty(..., &dl, &dl, &p)

The final value in dl is bytes_after_return, not nitems_return. For a
successfully read property, bytes_after is typically 0 (indicating all
data was retrieved), so the check `dl > 0` is always false and dwm never
reads any atom properties. So this is safe, but not very helpful :-)

dl is probably just a dummy variable anyway, so fix by using a separate
variable for nitems, and check nitems > 0 as originally intended.
This commit is contained in:
Chris Down 2026-01-14 14:58:05 +08:00 committed by Hiltjo Posthuma
parent 85fe518c1a
commit a9aa0d8ffb
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
dwm.c
View File

@ -864,13 +864,13 @@ Atom
getatomprop(Client *c, Atom prop) getatomprop(Client *c, Atom prop)
{ {
int di; int di;
unsigned long dl; unsigned long nitems, dl;
unsigned char *p = NULL; unsigned char *p = NULL;
Atom da, atom = None; Atom da, atom = None;
if (XGetWindowProperty(dpy, c->win, prop, 0L, sizeof atom, False, XA_ATOM, if (XGetWindowProperty(dpy, c->win, prop, 0L, sizeof atom, False, XA_ATOM,
&da, &di, &dl, &dl, &p) == Success && p) { &da, &di, &nitems, &dl, &p) == Success && p) {
if (dl > 0) if (nitems > 0)
atom = *(Atom *)p; atom = *(Atom *)p;
XFree(p); XFree(p);
} }