Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

From: NRK <nrk_AT_disroot.org>
Date: Mon, 24 Oct 2022 06:35:25 +0600

> On Sun, Oct 23, 2022 at 04:18:42PM +0000, Andy Gozas wrote:
> > St relies on an incorrect assumption of how XmbLookupString function
> > behaves.

Looking at the XmbLookupString manpage [0] reveals more trouble. It seems
that `ksym` might be used uninitalized as well. Inlined a proprosed
patch.

P.S: Please CC me on any replies, I seem to be missing a lot of mails
from the ML recently.

[0]: https://www.x.org/releases/X11R7.5/doc/man/man3/Xutf8LookupString.3.html

- NRK

diff --git a/x.c b/x.c
index f70e3fb..63886c7 100644
--- a/x.c
+++ b/x.c
_AT_@ -1847,35 +1847,40 @@ kpress(XEvent *ev)
 {
         XKeyEvent *e = &ev->xkey;
         KeySym ksym;
- char buf[64], *customkey;
+ char buf[512], *customkey;
         int len;
         Rune c;
         Status status;
         const Shortcut *bp;
+ int got_buf = 0, got_ksym = 0;
 
         if (IS_SET(MODE_KBDLOCK))
                 return;
 
- if (xw.ime.xic)
+ if (xw.ime.xic) {
                 len = XmbLookupString(xw.ime.xic, e, buf, sizeof buf, &ksym, &status);
- else
+ got_buf = status == XLookupBoth || status == XLookupChars;
+ got_ksym = status == XLookupBoth || status == XLookupKeySym;
+ } else {
                 len = XLookupString(e, buf, sizeof buf, &ksym, NULL);
+ got_buf = got_ksym = 1; /* TODO: is this correct? */
+ }
         /* 1. shortcuts */
         for (bp = shortcuts; bp < shortcuts + LEN(shortcuts); bp++) {
- if (ksym == bp->keysym && match(bp->mod, e->state)) {
+ if (got_ksym && ksym == bp->keysym && match(bp->mod, e->state)) {
                         bp->func(&(bp->arg));
                         return;
                 }
         }
 
         /* 2. custom keys from config.h */
- if ((customkey = kmap(ksym, e->state))) {
+ if (got_ksym && (customkey = kmap(ksym, e->state))) {
                 ttywrite(customkey, strlen(customkey), 1);
                 return;
         }
 
         /* 3. composed string from input method */
- if (len == 0)
+ if (len == 0 || !got_buf)
                 return;
         if (len == 1 && e->state & Mod1Mask) {
                 if (IS_SET(MODE_8BIT)) {
Received on Mon Oct 24 2022 - 02:35:25 CEST

This archive was generated by hypermail 2.3.0 : Mon Oct 24 2022 - 02:36:37 CEST