Skip to content
Snippets Groups Projects
  1. Dec 30, 2024
  2. Feb 11, 2024
  3. Apr 22, 2020
  4. Dec 08, 2018
  5. Feb 06, 2016
    • Alan Coopersmith's avatar
      xcms: use size_t for pointer offsets passed to strncmp · 6d7bb040
      Alan Coopersmith authored
      
      instead of converting to int and back
      
      Fixes clang warnings of the form:
      HVC.c:190:43: warning: implicit conversion changes signedness: 'int' to
            'unsigned long' [-Wsign-conversion]
                if (strncmp(spec, _XcmsTekHVC_prefix, n) != 0) {
                    ~~~~~~~
      
      Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
      6d7bb040
    • Alan Coopersmith's avatar
      xcms: use size_t for strlen/sizeof values instead of converting to int & back · 0ee0d383
      Alan Coopersmith authored
      
      Fixes gcc warnings of the form:
      
      IdOfPr.c: In function ‘XcmsFormatOfPrefix’:
      IdOfPr.c:69:32: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
           if ((len = strlen(prefix)) >= sizeof(string_buf)) {
                                      ^
      IdOfPr.c:83:11: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
         if (len >= sizeof(string_buf)) Xfree(string_lowered);
                 ^
      IdOfPr.c:97:11: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
         if (len >= sizeof(string_buf)) Xfree(string_lowered);
                 ^
      IdOfPr.c:104:13: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
           if (len >= sizeof(string_buf)) Xfree(string_lowered);
                   ^
      
      Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
      0ee0d383
  6. Oct 25, 2013
    • Alan Coopersmith's avatar
      Xcms file parsing should not require the impossible to succeed · 6cb02b16
      Alan Coopersmith authored
      The field2 helper function, to split lines from Xcms.txt files into
      two tab delimited fields, contained a check:
      
          if ((*pBuf != '\n') || (*pBuf != '\0')) {
              return(XcmsFailure);
      
      which would cause it to return failure unless *pBuf had a value that
      was simultaneously equal to both \n & \0, and no one wants to live in
      a world where that could ever be true.
      
      This has gone unnoticed since 1991, since this only caused lines
      in Xcms.txt that started with whitespace to be rejected, but now
      gcc -Wlogicalop has brought it to our attention, and
      https://bugs.freedesktop.org/show_bug.cgi?id=70803
      
       was filed.
      
      Now that we see it, and cannot unsee it, we change it to use the
      same logic as the check at other points in this function, to return
      failure only if we hit \n or \0 before we find the first non-whitespace
      character, so that lines starting with whitespace will have the space
      skipped over to get to the color name to be defined.
      
      Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
      Reviewed-by: default avatarDan Nicholson <dbn.lists@gmail.com>
      6cb02b16
  7. Aug 20, 2013
  8. May 10, 2013
    • Alan Coopersmith's avatar
      Integer overflows in stringSectionSize() cause buffer overflow in... · 90fd5aba
      Alan Coopersmith authored
      Integer overflows in stringSectionSize() cause buffer overflow in ReadColornameDB() [CVE-2013-1981 6/13]
      
      LoadColornameDB() calls stringSectionSize() to do a first pass over the
      file (which may be provided by the user via XCMSDB environment variable)
      to determine how much memory needs to be allocated to read in the file,
      then allocates the returned sizes and calls ReadColornameDB() to load the
      data from the file into that newly allocated memory.
      
      If stringSectionSize() overflows the signed ints used to calculate the
      file size (say if you have an xcmsdb with ~4 billion lines in or a
      combined string length of ~4 gig - which while it may have been
      inconceivable when Xlib was written, is quite possible today), then
      LoadColornameDB() may allocate a memory buffer much smaller than the
      amount of data ReadColornameDB() will write to it.
      
      The total size is left limited to an int, because if your xcmsdb file
      is larger than 2gb, you're doing it wrong.
      
      Reported-by: default avatarIlja Van Sprundel <ivansprundel@ioactive.com>
      Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
      Reviewed-by: default avatarMatthieu Herrb <matthieu.herrb@laas.fr>
      90fd5aba
  9. Feb 16, 2013
  10. Jan 03, 2013
  11. Feb 02, 2011
  12. Jan 15, 2010
  13. Jun 17, 2008
  14. Apr 26, 2008
  15. Apr 05, 2008
  16. Apr 06, 2007
  17. Jul 03, 2005
  18. May 13, 2005
  19. Apr 23, 2004
  20. Nov 14, 2003
Loading