From 612616aee64983f0c530dc951fcfc1356f0ab51f Mon Sep 17 00:00:00 2001 From: Ari Entlich Date: Mon, 22 Mar 2010 14:17:27 +0100 Subject: [PATCH] Fix possible memory corruption (FS#734) The memory referred to by the reply argument of property_update_wm_protocols is automatically free'd by xcb later on, so it is not safe to simply use the value of reply in our own data structures. If we did this, future calls to xcb_get_wm_protocols_reply_wipe free the data which has already been free'd by xcb, causing a double-free and corrupting the heap. In addition, it isn't safe to use free'd memory as if it is still allocated. Instead, duplicate the data referred to by reply and use the duplicate instead. It seems to me as if the duplication should actually be done in xcb_get_wm_protocols_from_reply, but I'm not really sure. If that is the case, this is simply a work-around until xcb can be fixed. Signed-off-by: Ari Entlich Signed-off-by: Julien Danjou --- property.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/property.c b/property.c index 9576bacc..8cc68060 100644 --- a/property.c +++ b/property.c @@ -313,11 +313,17 @@ void property_update_wm_protocols(client_t *c, xcb_get_property_reply_t *reply) { xcb_get_wm_protocols_reply_t protocols; + xcb_get_property_reply_t *reply_copy; if(reply) { - if(!xcb_get_wm_protocols_from_reply(reply, &protocols)) + reply_copy = p_dup(reply, 1); + + if(!xcb_get_wm_protocols_from_reply(reply_copy, &protocols)) + { + p_delete(&reply_copy); return; + } } else { -- 2.11.4.GIT