FVWM: patch to SendDataToModule (fvwm-2.0.45; fvwm/read.c)

From: Jacob Morzinski <jmorzins_at_MIT.EDU>
Date: Tue, 19 Aug 1997 02:27:22 EDT

The fvwm/read.c file in fvwm-2.0.45 has a bug; it uses a
fixed-length buffer for the message that it passes to modules.
This breaks (buffer overflow) on long PixmapPaths or IconPaths.

The supplied patch fixes the function to dynamically allocate space.


Sincerely,

-- 
 Jacob Morzinski                                jmorzins_at_mit.edu
--- fvwm/read.c	1997/06/01 00:51:08	1.1
+++ fvwm/read.c	1997/06/01 01:55:22	1.2
_at_@ -308,12 +308,34 @@
 	      unsigned long context, char *action, int *Module)
 {
   struct moduleInfoList *t;
-  char message[256];
+  char *message;
+  int message_len;
+  int tmp_len;
   extern char *IconPath;
 #ifdef XPM
   extern char *PixmapPath;
 #endif
 
+  /* The _right_ way to calculate the space requirement for *message
+   *  would be to preprocess this file with M4, have some macro
+   *  count the number of chars in each string ("fooPath"), and
+   *  substitute in the length of that string.
+   * I can't be sure of M4, so I computed the lengths by hand.
+   *  (Hey, fvwm is supposed to be _small_ and _fast_, right?)
+   */
+  message_len = (3 + 8		/* 8 == strlen("IconPath") */
+		 + strlen(IconPath));
+  tmp_len = (3 + 10		/* 10 == strlen("PixmapPath") */
+	     + strlen(PixmapPath));
+  if (tmp_len > message_len)
+    message_len = tmp_len;
+  tmp_len = (3 + 9		/* 9 == strlen("ClickTime") */
+	     + 20);		/* Generous space for "%d" */
+  if (tmp_len > message_len)
+    message_len = tmp_len;
+
+  message = safemalloc(message_len);
+
   sprintf(message,"IconPath %s\n",IconPath);
   SendName(*Module,M_CONFIG_INFO,0,0,0,message);
 #ifdef XPM
_at_@ -322,6 +344,8 @@
 #endif
   sprintf(message,"ClickTime %d\n",Scr.ClickTime);
   SendName(*Module,M_CONFIG_INFO,0,0,0,message);
+
+  free(message);
 
   t = modlistroot;
   while(t != NULL)
--
Visit the official FVWM web page at <URL:http://www.hpc.uh.edu/fvwm/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to majordomo_at_hpc.uh.edu.
To report problems, send mail to fvwm-owner_at_hpc.uh.edu.

Received on Tue Aug 19 1997 - 01:27:39 BST