Faris/dwm
1
0
Fork 0
mirror of git://git.suckless.org/dwm synced 2026-01-18 09:48:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: Faris:7c3abae4e68b6a21f05cb04f3af31217259c0aa9
Branches Tags
Faris:master
Faris:6.7
Faris:6.6
Faris:6.5
Faris:6.4
Faris:6.3
Faris:6.2
Faris:6.1
Faris:6.0
Faris:5.9
Faris:5.8.2
Faris:5.8.1
Faris:5.8
Faris:5.7.2
Faris:5.7.1
Faris:5.7
Faris:5.6.1
Faris:5.6
Faris:5.5
Faris:5.4.1
Faris:5.4
Faris:5.3.1
Faris:5.3
Faris:5.2
Faris:5.1
Faris:5.0
Faris:4.9
Faris:4.8
Faris:4.7
Faris:4.6
Faris:4.5
Faris:4.4.1
Faris:4.4
Faris:4.3
Faris:4.2
Faris:4.1
Faris:4.0
Faris:3.9
Faris:3.8
Faris:3.7
Faris:3.6.1
Faris:3.6
Faris:3.5
Faris:3.4
Faris:3.3
Faris:3.2.2
Faris:3.2.1
Faris:3.2
Faris:3.1
Faris:3.0
Faris:2.9
Faris:2.8
Faris:2.7
Faris:2.6
Faris:2.5.1
Faris:2.5
Faris:2.4
Faris:2.3
Faris:2.2
Faris:2.1
Faris:2.0
Faris:1.9
Faris:1.8
Faris:1.7.1
Faris:1.7
Faris:1.6
Faris:1.5
Faris:1.4
Faris:1.3
Faris:1.2
Faris:1.1
Faris:1.0
Faris:0.9
Faris:0.8
Faris:0.7
Faris:0.6
Faris:0.5
Faris:0.4
Faris:0.3
Faris:0.2
Faris:0.1
...
compare: Faris:85fe518c1af5eb43f222f4d8579e4814ed769f3b
Branches Tags
Faris:master
Faris:6.7
Faris:6.6
Faris:6.5
Faris:6.4
Faris:6.3
Faris:6.2
Faris:6.1
Faris:6.0
Faris:5.9
Faris:5.8.2
Faris:5.8.1
Faris:5.8
Faris:5.7.2
Faris:5.7.1
Faris:5.7
Faris:5.6.1
Faris:5.6
Faris:5.5
Faris:5.4.1
Faris:5.4
Faris:5.3.1
Faris:5.3
Faris:5.2
Faris:5.1
Faris:5.0
Faris:4.9
Faris:4.8
Faris:4.7
Faris:4.6
Faris:4.5
Faris:4.4.1
Faris:4.4
Faris:4.3
Faris:4.2
Faris:4.1
Faris:4.0
Faris:3.9
Faris:3.8
Faris:3.7
Faris:3.6.1
Faris:3.6
Faris:3.5
Faris:3.4
Faris:3.3
Faris:3.2.2
Faris:3.2.1
Faris:3.2
Faris:3.1
Faris:3.0
Faris:2.9
Faris:2.8
Faris:2.7
Faris:2.6
Faris:2.5.1
Faris:2.5
Faris:2.4
Faris:2.3
Faris:2.2
Faris:2.1
Faris:2.0
Faris:1.9
Faris:1.8
Faris:1.7.1
Faris:1.7
Faris:1.6
Faris:1.5
Faris:1.4
Faris:1.3
Faris:1.2
Faris:1.1
Faris:1.0
Faris:0.9
Faris:0.8
Faris:0.7
Faris:0.6
Faris:0.5
Faris:0.4
Faris:0.3
Faris:0.2
Faris:0.1

2 Commits
7c3abae4e6 ... 85fe518c1a

Author SHA1 Message Date
Hiltjo Posthuma
85fe518c1a bump version to 6.7 
Put the maintainer at the top and bump years (time flies).
 2026-01-10 11:31:44 +01:00
Chris Down
244fa852fe dwm: Fix heap buffer overflow in getatomprop 
When getatomprop() is called, it invokes XGetWindowProperty() to
retrieve an Atom. If the property exists but has zero elements (length
0), Xlib returns Success and sets p to a valid, non-NULL memory address
containing a single null byte.

However, dl (that is, the number of items) is 0. dwm blindly casts p to
Atom* and dereferences it. While Xlib guarantees that p is safe to read
as a string (that is, it is null-terminated), it does _not_ guarantee it
is safe to read as an Atom (an unsigned long).

The Atom type is a typedef for unsigned long. Reading an Atom (which
thus will either likely be 4 or 8 bytes) from a 1-byte allocated buffer
results in a heap buffer overflow. Since property content is user
controlled, this allows any client to trigger an out of bounds read
simply by setting a property with format 32 and length 0.

An example client which reliably crashes dwm under ASAN:

    #include <X11/Xlib.h>
    #include <X11/Xatom.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <unistd.h>

    int main(void) {
        Display *d;
        Window root, w;
        Atom net_wm_state;

        d = XOpenDisplay(NULL);
        if (!d) return 1;

        root = DefaultRootWindow(d);
        w = XCreateSimpleWindow(d, root, 10, 10, 200, 200, 1, 0, 0);
        net_wm_state = XInternAtom(d, "_NET_WM_STATE", False);
        if (net_wm_state == None) return 1;

        XChangeProperty(d, w, net_wm_state, XA_ATOM, 32,
                        PropModeReplace, NULL, 0);
        XMapWindow(d, w);
        XSync(d, False);
        sleep(1);

        XCloseDisplay(d);
        return 0;
    }

In order to avoid this, check that the number of items returned is
greater than zero before dereferencing the pointer.
 2026-01-10 11:27:23 +01:00
3 changed files with 4 additions and 3 deletions
Show Stats Expand all files Collapse all files

2
LICENSE
View File

@ -1,5 +1,6 @@
MIT/X Consortium License
© 2010-2026 Hiltjo Posthuma <hiltjo@codemadness.org>
© 2006-2019 Anselm R Garbe <anselm@garbe.ca>
© 2006-2009 Jukka Salmi <jukka at salmi dot ch>
© 2006-2007 Sander van Dijk <a dot h dot vandijk at gmail dot com>
@ -11,7 +12,6 @@ MIT/X Consortium License
© 2008 Martin Hurton <martin dot hurton at gmail dot com>
© 2008 Neale Pickett <neale dot woozle dot org>
© 2009 Mate Nagy <mnagy at port70 dot net>
© 2010-2016 Hiltjo Posthuma <hiltjo@codemadness.org>
© 2010-2012 Connor Lane Smith <cls@lubutu.com>
© 2011 Christoph Lohmann <20h@r-36.net>
© 2015-2016 Quentin Rameau <quinq@fifth.space>

2
config.mk
View File

@ -1,5 +1,5 @@
# dwm version
VERSION = 6.6
VERSION = 6.7
# Customize below to fit your system

3
dwm.c
View File

@ -870,7 +870,8 @@ getatomprop(Client *c, Atom prop)
if (XGetWindowProperty(dpy, c->win, prop, 0L, sizeof atom, False, XA_ATOM,
&da, &di, &dl, &dl, &p) == Success && p) {
atom = *(Atom *)p;
if (dl > 0)
atom = *(Atom *)p;
XFree(p);
}
return atom;