Skip to content

[gtk2] avoid buffer overflow in gdk_input_translate_coordinates in x11.c

Gabriel Scherer requested to merge gasche/gtk:gtk-2-24-fix-axes-overflow into gtk-2-24

The gtk2 gimp codebase passes an 'axes' array of size GDK_AXIS_LAST, and presumably other gdk users may make the same assumption. (In fact even GDK_AXIS_LAST - GDK_AXIS_X should be correct.) https://gitlab.gnome.org/GNOME/gimp/-/blob/b1fe1675/app/widgets/gimpdeviceinfo-coords.c?ref_type=heads#L124-133

Newer wacom device derivers support more axes, up to 8, see https://github.com/linuxwacom/xf86-input-wacom/issues/307 and they crash gimp 2.10.

The gtk3 versions of gimp have not seen a end-user release yet, so the majority of the gimp user codebase still uses gtk2; there have been many reports of users affected by this issue in the last few days, notably as Fedora 38 started shipping the new wacom driver.

gdk should guarantee that no more than (GDK_AXIS_LAST - GDK_AXIS_X) coordinates get written by gdk_device_get_state, and this patch fixes the x11 backend to provide this guarantee.

I reviewed the other backends and concluded that they already provide this guarantee:

  • win32 never adds unknown/ignored axes
  • quartz has a fixed set of supported device shapes, with at most 5 axes
  • directfb only supports 2 axes

Note: an alternative approach would be to ask gdk users to dynamically allocate their coordinate array using gdk_device_get_n_axes, but:

  • this requires changing user code
  • there is little point in writing out coordinates for ignored axes anyway, as user code is accessing them by use

Merge request reports