Skip to content

xkb: Fix heap overflow caused by optimized away min.

Matt Turner requested to merge mattst88/xserver:xkb-ub-fix into master

Calling strlen on char[4] that does not need to contain '\0' is wrong and X server may end up running into uninitialized memory.

In addition GCC 8 is clever enough that it knows that strlen on char[4] can return 0, 1, 2, 3 or cause undefined behavior. With this knowledge it can optimize away the min(..., 4). In reality it can cause the memcpy to be called with bigger size than 4 and overflow the destination buffer.

Fixes: 83913de2 (xkb: Silence some compiler warnings) Closes: #288 (closed) Signed-off-by: Matt Turner mattst88@gmail.com

cc: @ajax

Merge request reports