From: Kristian Høgsberg <krh@bitplanet.net>
Date: Mon, 15 Oct 2012 21:19:38 +0000 (-0400)
Subject: connection: return error on buffer-overflow during read
X-Git-Tag: accepted/2.0alpha-wayland/20121109.201735~40
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=04720307e91c45a772858fd3fcb0203a0b68ac17;p=profile%2Fivi%2Fwayland.git

connection: return error on buffer-overflow during read

wl_connection_read() assumes that the caller dispatched all messages
before calling it. wl_buffer_put_iov() does only provide enough room so we
fill the buffer. So the only case when the buffer overflows, is when a
previous read filled up the buffer but we couldn't parse a single message
from it. In this case, the client sent a message bigger than our buffer
and we should return an error and close the connection.

krh: Edited from Davids original patch to just check that the buffer
 isn't full before we try reading into it.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
---

diff --git a/src/connection.c b/src/connection.c
index b00491e..fdc9309 100644
--- a/src/connection.c
+++ b/src/connection.c
@@ -314,6 +314,11 @@ wl_connection_read(struct wl_connection *connection)
 	char cmsg[CLEN];
 	int len, count, ret;
 
+	if (wl_buffer_size(&connection->in) >= sizeof(connection->in.data)) {
+		errno = EOVERFLOW;
+		return -1;
+	}
+
 	wl_buffer_put_iov(&connection->in, iov, &count);
 
 	msg.msg_name = NULL;