[PATCH wayland 3/4] Add a version field to wl_resource and verify request versions before calling them
Jason Ekstrand
jason at jlekstrand.net
Thu Jun 27 18:09:20 PDT 2013
This commit provides a layer of protection for the compositor in the form
of message version checking. Version information is provided to libwayland
as an aditional argument to wl_client_add_object and wl_client_new_object.
libwayland then uses this version information to verify that a request
exists in that protocol version before invoking it. This way libwayland
won't accidentally invoke a request that does not exist and thereby cause
the compositor to crash.
Signed-off-by: Jason Ekstrand <jason at jlekstrand.net>
---
src/wayland-server.c | 64 ++++++++++++++++++++++++++++++++++++++++++++--------
src/wayland-server.h | 12 ++++++++++
src/wayland-shm.c | 24 ++++++++++++--------
3 files changed, 80 insertions(+), 20 deletions(-)
diff --git a/src/wayland-server.c b/src/wayland-server.c
index 0c3fbc9..67d52bd 100644
--- a/src/wayland-server.c
+++ b/src/wayland-server.c
@@ -109,6 +109,7 @@ struct wl_resource {
struct wl_signal destroy_signal;
struct wl_client *client;
void *data;
+ int version;
};
static int wl_debug = 0;
@@ -210,6 +211,7 @@ wl_client_connection_data(int fd, uint32_t mask, void *data)
struct wl_closure *closure;
const struct wl_message *message;
uint32_t p[2];
+ uint32_t resource_flags;
int opcode, size;
int len;
@@ -246,6 +248,7 @@ wl_client_connection_data(int fd, uint32_t mask, void *data)
break;
resource = wl_map_lookup(&client->objects, p[0]);
+ resource_flags = wl_map_lookup_flags(&client->objects, p[0]);
if (resource == NULL) {
wl_resource_post_error(client->display_resource,
WL_DISPLAY_ERROR_INVALID_OBJECT,
@@ -265,6 +268,19 @@ wl_client_connection_data(int fd, uint32_t mask, void *data)
}
message = &object->interface->methods[opcode];
+ if (!(resource_flags & WL_MAP_ENTRY_LEGACY) &&
+ resource->version > 0 &&
+ resource->version < wl_message_get_since(message)) {
+ wl_resource_post_error(client->display_resource,
+ WL_DISPLAY_ERROR_INVALID_METHOD,
+ "invalid method %d, object %s@%u",
+ opcode,
+ object->interface->name,
+ object->id);
+ break;
+ }
+
+
closure = wl_connection_demarshal(client->connection, size,
&client->objects, message);
len -= size;
@@ -510,6 +526,12 @@ wl_resource_get_user_data(struct wl_resource *resource)
return resource->data;
}
+WL_EXPORT int
+wl_resource_get_version(struct wl_resource *resource)
+{
+ return resource->version;
+}
+
WL_EXPORT void
wl_resource_set_destructor(struct wl_resource *resource,
wl_resource_destroy_func_t destroy)
@@ -603,8 +625,9 @@ display_sync(struct wl_client *client,
struct wl_resource *callback;
uint32_t serial;
- callback = wl_client_add_object(client,
- &wl_callback_interface, NULL, id, NULL);
+ callback = wl_client_add_versioned_object(client,
+ &wl_callback_interface, 1,
+ NULL, id, NULL);
serial = wl_display_get_serial(client->display);
wl_callback_send_done(callback, serial);
wl_resource_destroy(callback);
@@ -626,8 +649,9 @@ display_get_registry(struct wl_client *client,
struct wl_global *global;
registry_resource =
- wl_client_add_object(client, &wl_registry_interface,
- ®istry_interface, id, display);
+ wl_client_add_versioned_object(client, &wl_registry_interface,
+ 1, ®istry_interface, id,
+ display);
registry_resource->destroy = unbind_resource;
wl_list_insert(&display->registry_resource_list,
@@ -660,8 +684,8 @@ bind_display(struct wl_client *client,
struct wl_display *display = data;
client->display_resource =
- wl_client_add_object(client, &wl_display_interface,
- &display_interface, id, display);
+ wl_client_add_versioned_object(client, &wl_display_interface, 1,
+ &display_interface, id, display);
if(client->display_resource)
client->display_resource->destroy = destroy_client_display_resource;
@@ -998,8 +1022,17 @@ wl_display_get_destroy_listener(struct wl_display *display,
WL_EXPORT struct wl_resource *
wl_client_add_object(struct wl_client *client,
const struct wl_interface *interface,
- const void *implementation,
- uint32_t id, void *data)
+ const void *implementation, uint32_t id, void *data)
+{
+ return wl_client_add_versioned_object(client, interface, -1,
+ implementation, id, data);
+}
+
+WL_EXPORT struct wl_resource *
+wl_client_add_versioned_object(struct wl_client *client,
+ const struct wl_interface *interface,
+ int version, const void *implementation,
+ uint32_t id, void *data)
{
struct wl_resource *resource;
@@ -1018,6 +1051,7 @@ wl_client_add_object(struct wl_client *client,
resource->destroy = NULL;
resource->client = client;
resource->data = data;
+ resource->version = version;
if (wl_map_insert_at(&client->objects, 0, resource->object.id, resource) < 0) {
wl_resource_post_error(client->display_resource,
@@ -1036,11 +1070,21 @@ wl_client_new_object(struct wl_client *client,
const struct wl_interface *interface,
const void *implementation, void *data)
{
+ return wl_client_new_versioned_object(client, interface, -1,
+ implementation, data);
+}
+
+WL_EXPORT struct wl_resource *
+wl_client_new_versioned_object(struct wl_client *client,
+ const struct wl_interface *interface,
+ int version, const void *implementation,
+ void *data)
+{
uint32_t id;
id = wl_map_insert_new(&client->objects, 0, NULL);
- return wl_client_add_object(client,
- interface, implementation, id, data);
+ return wl_client_add_versioned_object(client, interface, version,
+ implementation, id, data);
}
diff --git a/src/wayland-server.h b/src/wayland-server.h
index 7c53cfc..8924128 100644
--- a/src/wayland-server.h
+++ b/src/wayland-server.h
@@ -131,10 +131,20 @@ wl_client_add_object(struct wl_client *client,
const struct wl_interface *interface,
const void *implementation, uint32_t id, void *data);
struct wl_resource *
+wl_client_add_versioned_object(struct wl_client *client,
+ const struct wl_interface *interface,
+ int version, const void *implementation,
+ uint32_t id, void *data);
+struct wl_resource *
wl_client_new_object(struct wl_client *client,
const struct wl_interface *interface,
const void *implementation, void *data);
struct wl_resource *
+wl_client_new_versioned_object(struct wl_client *client,
+ const struct wl_interface *interface,
+ int version, const void *implementation,
+ void *data);
+struct wl_resource *
wl_client_get_object(struct wl_client *client, uint32_t id);
struct wl_listener {
@@ -258,6 +268,8 @@ void
wl_resource_set_user_data(struct wl_resource *resource, void *data);
void *
wl_resource_get_user_data(struct wl_resource *resource);
+int
+wl_resource_get_version(struct wl_resource *resource);
void
wl_resource_set_destructor(struct wl_resource *resource,
wl_resource_destroy_func_t destroy);
diff --git a/src/wayland-shm.c b/src/wayland-shm.c
index 8a10253..e37b7d9 100644
--- a/src/wayland-shm.c
+++ b/src/wayland-shm.c
@@ -127,9 +127,10 @@ shm_pool_create_buffer(struct wl_client *client, struct wl_resource *resource,
buffer->pool = pool;
pool->refcount++;
- buffer->resource = wl_client_add_object(client, &wl_buffer_interface,
- &shm_buffer_interface,
- id, buffer);
+ buffer->resource =
+ wl_client_add_versioned_object(client, &wl_buffer_interface, 1,
+ &shm_buffer_interface,
+ id, buffer);
wl_resource_set_destructor(buffer->resource, destroy_buffer);
}
@@ -204,8 +205,9 @@ shm_create_pool(struct wl_client *client, struct wl_resource *resource,
}
close(fd);
- pool->resource = wl_client_add_object(client, &wl_shm_pool_interface,
- &shm_pool_interface, id, pool);
+ pool->resource =
+ wl_client_add_versioned_object(client, &wl_shm_pool_interface, 1,
+ &shm_pool_interface, id, pool);
if (!pool->resource)
goto err_free;
@@ -229,8 +231,8 @@ bind_shm(struct wl_client *client,
{
struct wl_resource *resource;
- resource = wl_client_add_object(client, &wl_shm_interface,
- &shm_interface, id, data);
+ resource = wl_client_add_versioned_object(client, &wl_shm_interface, 1,
+ &shm_interface, id, data);
wl_shm_send_format(resource, WL_SHM_FORMAT_ARGB8888);
wl_shm_send_format(resource, WL_SHM_FORMAT_XRGB8888);
@@ -272,9 +274,11 @@ wl_shm_buffer_create(struct wl_client *client,
buffer->pool = NULL;
- buffer->resource = wl_client_add_object(client, &wl_buffer_interface,
- &shm_buffer_interface,
- id, buffer);
+ buffer->resource =
+ wl_client_add_versioned_object(client,
+ &wl_buffer_interface, 1,
+ &shm_buffer_interface,
+ id, buffer);
wl_resource_set_destructor(buffer->resource, destroy_buffer);
return buffer;
--
1.8.2.1
More information about the wayland-devel
mailing list