libxtrans: Changes to 'master'

Alan Coopersmith alanc at kemper.freedesktop.org
Wed Dec 14 20:43:02 PST 2011


 Xtranssock.c |   14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

New commits:
commit 6086f6c1d0e0a1c9e590879acb2319dea0eb6e96
Author: Robert Bragg <robert at linux.intel.com>
Date:   Mon Dec 12 00:30:43 2011 +0000

    Xtranssock.c: avoid buffer overrun in SocketReopen
    
    This function was constructing an address from a port string allocating
    a buffer according to the size of the string but then later copying
    the address according to sizeof(struct sockaddr).
    
    This patch ensures that we allocate a struct sockaddr buffer with enough
    space for the port string to be copied into sa_data[] and uses that
    combined length to determine how much should be copied at the end of the
    function.
    
    This fixes a crash when using xwayland which uses ListenOnOpenFD() that
    will call _XSERVTransReopenCOTSServer() with a short port string like
    ":1".
    
    Signed-off-by: Robert Bragg <robert at linux.intel.com>
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>



More information about the xorg-commit mailing list