[Xcb] [Bug 93268] New: Invalid memory access in xcb_icccm_get_wm_class_from_reply

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=93268

            Bug ID: 93268
           Summary: Invalid memory access in
                    xcb_icccm_get_wm_class_from_reply
           Product: XCB
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Utils
          Assignee: xcb at lists.freedesktop.org
          Reporter: jpinon at free.fr
        QA Contact: xcb at lists.freedesktop.org

I fell in a case where in xcb_icccm_get_wm_class_from_reply, the reply was
empty, i.e., in following snippet from icccm.c, len was 0, and reply->length
was 0 also.

  int len = xcb_get_property_value_length(prop->_reply);
  if(len < reply->length * 4)
    prop->instance_name[len] = 0;
  else
    prop->instance_name[len-1] = 0;

in this case, prop->instance_name[-1] is set to 0, and the following
strlen(prop->instance_name) may access invalid memory.

This may be reproduced under openbox window manager, under which there is this
window triggering the bug :

If xwininfo is compiled without icccm :
./xwininfo -tree -root | grep Openbox
     0xe0008b "Openbox": ("" (none))  1x1+-100+-100  +-100+-100

If xwininfo is compiled with icccm :
./xwininfo -tree -root | grep Openbox                                           
     0xe0008b "Openbox": ("" "")  1x1+-100+-100  +-100+-100

The second case triggers the Invalid memory access

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/xcb/attachments/20151205/5d43464a/attachment.html>