Subject: FVWM: patch to SendDataToModule (fvwm-2.0.45; fvwm/read.c)

From: "Jacob Morzinski" <[email-masked]>
Date: Tue, 19 Aug 1997 02:27:22 EDT

The fvwm/read.c file in fvwm-2.0.45 has a bug; it uses a
fixed-length buffer for the message that it passes to modules.
This breaks (buffer overflow) on long PixmapPaths or IconPaths.

The supplied patch fixes the function to dynamically allocate space.

Sincerely,
-- 
 Jacob Morzinski                                [email-masked]

--- fvwm/read.c	1997/06/01 00:51:08	1.1
+++ fvwm/read.c	1997/06/01 01:55:22	1.2
@@ -308,12 +308,34 @@
 	      unsigned long context, char *action, int *Module)
 {
   struct moduleInfoList *t;
-  char message[256];
+  char *message;
+  int message_len;
+  int tmp_len;
   extern char *IconPath;
 #ifdef XPM
   extern char *PixmapPath;
 #endif
 
+  /* The _right_ way to calculate the space requirement for *message
+   *  would be to preprocess this file with M4, have some macro
+   *  count the number of chars in each string ("fooPath"), and
+   *  substitute in the length of that string.
+   * I can't be sure of M4, so I computed the lengths by hand.
+   *  (Hey, fvwm is supposed to be _small_ and _fast_, right?)
+   */
+  message_len = (3 + 8		/* 8 == strlen("IconPath") */
+		 + strlen(IconPath));
+  tmp_len = (3 + 10		/* 10 == strlen("PixmapPath") */
+	     + strlen(PixmapPath));
+  if (tmp_len > message_len)
+    message_len = tmp_len;
+  tmp_len = (3 + 9		/* 9 == strlen("ClickTime") */
+	     + 20);		/* Generous space for "%d" */
+  if (tmp_len > message_len)
+    message_len = tmp_len;
+
+  message = safemalloc(message_len);
+
   sprintf(message,"IconPath %s\n",IconPath);
   SendName(*Module,M_CONFIG_INFO,0,0,0,message);
 #ifdef XPM
@@ -322,6 +344,8 @@
 #endif
   sprintf(message,"ClickTime %d\n",Scr.ClickTime);
   SendName(*Module,M_CONFIG_INFO,0,0,0,message);
+
+  free(message);
 
   t = modlistroot;
   while(t != NULL)
--
Visit the official FVWM web page at <URL:http://www.hpc.uh.edu/fvwm/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to [email-masked].
To report problems, send mail to [email-masked].