Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-24 Thread Andy Gozas
On 2022-10-24 10:30 AM, NRK wrote: On Mon, Oct 24, 2022 at 01:10:29PM +0300, Santtu Lakkala wrote: The dynmaic[sic] version incorrectly passes sizeof(buf), where buf is char *, as the size of buffer in the "happy case" leading to unnecessary hits to the dynamic path. Ah yes, the classic. Att

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-24 Thread Andy Gozas
On 2022-10-24 10:01 AM, NRK wrote: On Mon, Oct 24, 2022 at 09:21:37AM +, Andy Gozas wrote: • XmbLookupString leaves the ksym unchanged if not filled and XLookupString [probably] sets it to NoSymbol (that's what XLookupKeysym does, but whether or not XLookupString shares this behavior is unc

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-24 Thread NRK
On Mon, Oct 24, 2022 at 01:10:29PM +0300, Santtu Lakkala wrote: > The dynmaic[sic] version incorrectly passes sizeof(buf), where buf is char > *, as the size of buffer in the "happy case" leading to unnecessary hits to > the dynamic path. Ah yes, the classic. Attached ammended version of the dynma

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-24 Thread Santtu Lakkala
On 24.10.2022 13.01, NRK wrote:> But which approach to take is the maintainer's call, not mine. I've attched both fixed-size and dynamic-allocation patch (but simplified without goto). The dynmaic[sic] version incorrectly passes sizeof(buf), where buf is char *, as the size of buffer in the "h

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-24 Thread NRK
On Mon, Oct 24, 2022 at 09:21:37AM +, Andy Gozas wrote: > • XmbLookupString leaves the ksym unchanged if not filled and XLookupString > [probably] sets it to NoSymbol (that's what XLookupKeysym does, but whether > or not XLookupString shares this behavior is unclear [1]), so we can just > set i

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-24 Thread Andy Gozas
On 2022-10-24 12:35 AM, NRK wrote: On Sun, Oct 23, 2022 at 04:18:42PM +, Andy Gozas wrote: > St relies on an incorrect assumption of how XmbLookupString function > behaves. Looking at the XmbLookupString manpage [0] reveals more trouble. It seems that `ksym` might be used uninitalized as

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-23 Thread NRK
> On Sun, Oct 23, 2022 at 04:18:42PM +, Andy Gozas wrote: > > St relies on an incorrect assumption of how XmbLookupString function > > behaves. Looking at the XmbLookupString manpage [0] reveals more trouble. It seems that `ksym` might be used uninitalized as well. Inlined a proprosed patch.

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-23 Thread Andy Gozas
On 2022-10-23 05:34 PM, Hiltjo Posthuma wrote: Can you provide a minimal reproducable-case with your configuration for this issue? It would help a lot in reviewing this issue. Yes, of course. If you already have the multi-key enabled on your system, then add this line to your ~/.XCompose file

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-23 Thread Hiltjo Posthuma
On Sun, Oct 23, 2022 at 04:18:42PM +, Andy Gozas wrote: > This is a fix for a problem with ST that I found. > > St relies on an incorrect assumption of how XmbLookupString function > behaves. When a composed input comes with a string that can not fit into the > buffer that was given to it — it

Re: [hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-23 Thread Andy Gozas
This is a fix for a problem with ST that I found. St relies on an incorrect assumption of how XmbLookupString function behaves. When a composed input comes with a string that can not fit into the buffer that was given to it — it doesn't fill it however much it can, and then return exactly how

[hackers] [st][PATCH] Fix buffer overflow when handling composed input

2022-10-23 Thread Andy Gozas
--- x.c | 41 +++-- 1 file changed, 31 insertions(+), 10 deletions(-) diff --git a/x.c b/x.c index 2a3bd38..8d14fc1 100644 --- a/x.c +++ b/x.c @@ -1834,8 +1834,10 @@ kpress(XEvent *ev) { XKeyEvent *e = &ev->xkey; KeySym ksym; - char buf[6