Commit 04720307 authored by Kristian Høgsberg's avatar Kristian Høgsberg
Browse files

connection: return error on buffer-overflow during read



wl_connection_read() assumes that the caller dispatched all messages
before calling it. wl_buffer_put_iov() does only provide enough room so we
fill the buffer. So the only case when the buffer overflows, is when a
previous read filled up the buffer but we couldn't parse a single message
from it. In this case, the client sent a message bigger than our buffer
and we should return an error and close the connection.

krh: Edited from Davids original patch to just check that the buffer
 isn't full before we try reading into it.
Signed-off-by: default avatarDavid Herrmann <dh.herrmann@googlemail.com>
parent ad03a59f
......@@ -314,6 +314,11 @@ wl_connection_read(struct wl_connection *connection)
char cmsg[CLEN];
int len, count, ret;
if (wl_buffer_size(&connection->in) >= sizeof(connection->in.data)) {
errno = EOVERFLOW;
return -1;
}
wl_buffer_put_iov(&connection->in, iov, &count);
msg.msg_name = NULL;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment