gryf/wmaker
1
0
Fork 0
mirror of https://github.com/gryf/wmaker.git synced 2026-06-16 23:45:25 +02:00
Code Issues Projects Releases Wiki Activity

wmaker: fix integer overflow in _NET_WM_ICON parser

Browse Source 
findBestIcon() multiplies two attacker-controlled 32-bit ints (icon
width * height) without overflow checking. A client setting
_NET_WM_ICON = {2, 0x7FFFFFFF} makes "size" wrap to 0 so "i += size"
never advances and wmaker spins forever at 100% CPU.

The same loop also never verifies that the claimed icon actually fits
inside the property buffer, allowing a 2-element property to drive a
multi-KB OOB read in makeRImageFromARGBData().

Validate dimensions against a 4096-pixel cap (safe from unsigned long
overflow) and reject icons whose pixel data would extend past the end
of the property.
This commit is contained in:
David Maciejak
2026-04-09 22:55:00 +00:00
committed by Carlos R. Mafra
parent 931186bd18
commit 5eb3287535
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/wmspec.c
+10 -4
View File
@@ -458,9 +458,11 @@ static RImage *findBestIcon(unsigned long *data, unsigned long items)
/* get the current icon's size */ /* get the current icon's size */
sx = (int)data[i]; sx = (int)data[i];
sy = (int)data[i + 1]; sy = (int)data[i + 1];
if ((sx < 1) || (sy < 1)) if (sx < 1 || sy < 1 || sx > 4096 || sy > 4096)
break;
size = (unsigned long)sx * (unsigned long)sy + 2;
if ((unsigned long)size > items - i)
break; break;
size = sx * sy + 2;
/* check the size difference if it's not too large */ /* check the size difference if it's not too large */
if ((sx <= wanted) && (sy <= wanted)) { if ((sx <= wanted) && (sy <= wanted)) {
@@ -485,8 +487,12 @@ static RImage *findBestIcon(unsigned long *data, unsigned long items)
* small image by a small scale. */ * small image by a small scale. */
largest = 0; largest = 0;
for (i = 0L; i < items - 1;) { for (i = 0L; i < items - 1;) {
size = (int)data[i] * (int)data[i + 1]; sx = (int)data[i];
if (size == 0) sy = (int)data[i + 1];
if (sx < 1 || sy < 1 || sx > 4096 || sy > 4096)
break;
size = (unsigned long)sx * (unsigned long)sy;
if ((unsigned long)size + 2 > items - i)
break; break;
if (size > largest) { if (size > largest) {
icon = &data[i]; icon = &data[i];