[Wayland-bugs] [Bug 767241] wayland: Long window titles crash clients

[gtk+ (GNOME Bugzilla)]

https://bugzilla.gnome.org/show_bug.cgi?id=767241

Carlos Garnacho <carlosg at gnome.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |carlosg at gnome.org

--- Comment #6 from Carlos Garnacho <carlosg at gnome.org> ---
(In reply to Matthias Clasen from comment #3)
> But the buffers we use are created by wl_shm_pool_create_buffer. We use it
> for the entire window contents w*scale * h*scale * 4 bytes - that can easily
> go beyond 4096. I must say wl_buffer is very confusing in the wayland
> codebase. There's some headers where it is deprecated, e.g.
> 
> Clearly, more information is needed. Jonas ?

AFAICS here wl_buffer seems to refer to lowlevel message buffers, not the high
level "image buffer" object exposed in the protocol.

(In reply to Matthias Clasen from comment #4)
> Looks like a libwayland bug to me.
> 
> I think wl_connection_write is missing a loop to deal with size > 4096 in
> chunks.

If I did read the code correctly yesterday, each of those wl_buffer structs
must begin with the object ID, opcode, etc. So effectively a single request
can't be split in chunks.

(In reply to Matthias Clasen from comment #5)
> Alternatively, the wayland documentation should clearly state that string
> arguments will be limited to 4088 bytes. That probably affects not just the
> title, but also the app id in the xdg-shell protocol.

Agreed about the general lack of documentation, this potentially affects every
request that has variable length fields (strings and arrays basically). Will
bring it up on wayland-devel.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/wayland-bugs/attachments/20160605/e98997ad/attachment.html>