[PATCH 1/5] Crash if zero data but non-zero fd's in message

spitzak at gmail.com spitzak at gmail.com
Sun Mar 18 22:56:18 PDT 2012


From: Bill Spitzak <spitzak at lulu.(none)>

connection.c sent a 4096 byte block of garbage if it wanted to send an
fd and there happened to be zero data to send as well.
---
 src/connection.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/src/connection.c b/src/connection.c
index fa01545..1f707ed 100644
--- a/src/connection.c
+++ b/src/connection.c
@@ -124,6 +124,10 @@ wl_buffer_get_iov(struct wl_buffer *b, struct iovec *iov, int *count)
 {
 	int head, tail;
 
+	if (b->head == b->tail) {
+		*count = 0;
+		return;
+	}
 	head = MASK(b->head);
 	tail = MASK(b->tail);
 	if (tail < head) {
-- 
1.7.4.1



More information about the wayland-devel mailing list