Commit 634ab70d authored by Hanno Böck's avatar Hanno Böck Committed by Ray Strode
Browse files

main: fix heap overflow in dbus-launch wrapping

I have discovered a heap overflow with the help of an address sanitizer.

The require_dbus_session() function has this code:

        new_argv = g_malloc (argc + 3 * sizeof (*argv));

The intention is to allocate space for (argc + 3) pointers. However obviously a
parenthesis is missing, therefore only argc bytes + 3 * pointer size gets
allocated, which is insufficient space. This leads to invalid memory writes.

The fix is trivial: Parentheses around argc + 3.
parent fdd28635
......@@ -187,7 +187,7 @@ require_dbus_session (int argc,
/* +2 for our new arguments, +1 for NULL */
new_argv = g_malloc (argc + 3 * sizeof (*argv));
new_argv = g_malloc ((argc + 3) * sizeof (*argv));
new_argv[0] = "dbus-launch";
new_argv[1] = "--exit-with-session";
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment