[plasma/kwin-x11/Plasma/6.7] src: main_x11: avoid overflowing crash restart command

Git commit 90a19ee09583e8581242c4faf90e21dd54521605 by Mikhail Dmitrichenko.
Committed on 20/07/2026 at 12:57.
Pushed by vladz into branch 'Plasma/6.7'.

main_x11: avoid overflowing crash restart command

ApplicationX11::crashHandler() builds the restart command in a
fixed-size buffer with sprintf(). The application path may be longer
than the buffer used by the crash restart path, which can overflow cmd
before system() is called.

Use snprintf() and skip the restart if the command does not fit.

Signed-off-by: Mikhail Dmitrichenko <[email protected]>

M  +5    -1    src/main_x11.cpp

https://invent.kde.org/plasma/kwin-x11/-/commit/90a19ee09583e8581242c4faf90e21dd54521605

diff --git a/src/main_x11.cpp b/src/main_x11.cpp
index b2910497b3..fb31b4a932 100644
--- a/src/main_x11.cpp
+++ b/src/main_x11.cpp
@@ -370,8 +370,12 @@ void ApplicationX11::crashHandler(int signal)
 
     fprintf(stderr, "Application::crashHandler() called with signal %d; recent crashes: %d\n", signal, crashes);
     char cmd[1024];
-    sprintf(cmd, "%s --crashes %d &",
+    const int written = snprintf(cmd, sizeof(cmd), "%s --crashes %d &",
             QFile::encodeName(QCoreApplication::applicationFilePath()).constData(), crashes);
+    if (written < 0 || static_cast<size_t>(written) >= sizeof(cmd)) {
+        fprintf(stderr, "Application::crashHandler() restart command is too long, not restarting\n");
+        return;
+    }
 
     sleep(1);
     system(cmd);