Fix segmentation violation in ewmh_set_icon
Stephan Diestelhorst <[email protected]>
| Newsgroups | gmane.network.rdesktop.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi, on my 64 bit system I get segmentation violation errors in ewmh_set_icon, when using seamless RDP and a new window opens. I have debugged this to be caused by corrupt sizes being returned for the icons in _NET_WM_ICON, or rather a wrong interpretation. Funny thing is, despite the specification of 32 bit cardinals for the return array, the X specifcation mandates that those will nevertheless be stored in longs, which are 64bit on 64 bit machines. See also the discussion at http://www.mail-archive.com/[email protected]/msg00314.html The attached patch drops uint32 and replaces with long and sizeof(long). It also adds checking for i vs nitems. Could you please apply to upstream rdesktop? Thanks, Stephan ------------------------------------------------------------------------------ Download new Adobe(R) Flash(R) Builder(TM) 4 The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly Flex(R) Builder(TM)) enable the development of rich applications that run across multiple browsers and platforms. Download your free trials today! http://p.sf.net/sfu/adobe-dev2dev _______________________________________________ rdesktop-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/rdesktop-devel
rdesktop_ewmhints_fixicons.patch
(text/x-patch, 1.2 KB)
--- rdesktop-1.6.0/ewmhints.c 2008-04-02 13:13:22.000000000 +0200
+++ rdesktop-1.6.0.fix/ewmhints.c 2010-10-18 12:04:58.955727036 +0200
@@ -432,15 +432,15 @@
{
unsigned long nitems, i;
unsigned char *props;
- uint32 *cur_set, *new_set;
- uint32 *icon;
+ long *cur_set, *new_set;
+ long *icon;
cur_set = NULL;
new_set = NULL;
if (get_property_value(wnd, "_NET_WM_ICON", 10000, &nitems, &props, 1) >= 0)
{
- cur_set = (uint32 *) props;
+ cur_set = (long *) props;
for (i = 0; i < nitems;)
{
@@ -450,19 +450,24 @@
i += 2 + cur_set[i] * cur_set[i + 1];
}
- if (i != nitems)
+ if (i != nitems) {
+ if (i > nitems) {
+ error("i %i vs nitems %i\n", i, nitems);
+ exit(1);
+ }
icon = cur_set + i;
+ }
else
{
- new_set = xmalloc((nitems + width * height + 2) * 4);
- memcpy(new_set, cur_set, nitems * 4);
+ new_set = xmalloc((nitems + width * height + 2) * sizeof(long));
+ memcpy(new_set, cur_set, nitems * sizeof(long));
icon = new_set + nitems;
nitems += width * height + 2;
}
}
else
{
- new_set = xmalloc((width * height + 2) * 4);
+ new_set = xmalloc((width * height + 2) * sizeof(long));
icon = new_set;
nitems = width * height + 2;
}