This is an automated email from the git hooks/post-receive script. x2go pushed a commit to branch 3.6.x in repository nx-libs. commit ae037701fe9a6337375d51abb2ea5b7aafdb434e Author: Ulrich Sibiller <uli42@gmx.de> Date: Fri Oct 2 22:11:04 2020 +0200 nxagent: fix stack smashing In compext Atom has the size of XlibAtom. Therefore calling functions of Compext.c requires to use/pass XlibAtom. Same for Window/XlibWindow. ==15438==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffffcdc0 at pc 0x5555556a81b5 bp 0x7fffffffcd10 sp 0x7fffffffcd08 WRITE of size 8 at 0x7fffffffcdc0 thread T0 #0 0x5555556a81b4 in NXGetCollectedProperty nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c:4124 #1 0x5555557d0488 in nxagentCollectPropertyEvent nx-X11/programs/Xserver/hw/nxagent/Clipboard.c:1202 #2 0x555555723340 in nxagentHandleCollectPropertyEvent nx-X11/programs/Xserver/hw/nxagent/Events.c:3923 #3 0x55555571d4db in nxagentHandleProxyEvent nx-X11/programs/Xserver/hw/nxagent/Events.c:3007 #4 0x55555571bb92 in nxagentHandleClientMessageEvent nx-X11/programs/Xserver/hw/nxagent/Events.c:2595 #5 0x555555717dfc in nxagentDispatchEvents nx-X11/programs/Xserver/hw/nxagent/Events.c:1827 #6 0x555555750813 in nxagentBlockHandler nx-X11/programs/Xserver/hw/nxagent/Handlers.c:437 #7 0x5555556c1b5d in BlockHandler nx-X11/programs/Xserver/dix/dixutils.c:403 #8 0x5555556d47ff in WaitForSomething nx-X11/programs/Xserver/os/WaitFor.c:232 #9 0x555555665b22 in Dispatch nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c:365 #10 0x5555555ed760 in main nx-X11/programs/Xserver/dix/main.c:350 #11 0x7ffff604909a in __libc_start_main ../csu/libc-start.c:308 #12 0x5555555edc09 in _start (nx-X11/programs/Xserver/nxagent+0x99c09) Address 0x7fffffffcdc0 is located in stack of thread T0 at offset 32 in frame #0 0x5555557d0324 in nxagentCollectPropertyEvent nx-X11/programs/Xserver/hw/nxagent/Clipboard.c:1190 This frame has 5 object(s): [32, 36) 'atomReturnType' <== Memory access at offset 32 partially overflows this variable [96, 100) 'resultFormat' [160, 168) 'ulReturnItems' [224, 232) 'ulReturnBytesLeft' [288, 296) 'pszReturnData' HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c:4124 in NXGetCollectedProperty ... --- nx-X11/programs/Xserver/hw/nxagent/Clipboard.c | 2 +- nx-X11/programs/Xserver/hw/nxagent/Events.c | 6 +++--- nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c | 6 ++++++ nx-X11/programs/Xserver/hw/nxagent/compext/Compext.h | 12 ++++++++++++ 4 files changed, 22 insertions(+), 4 deletions(-) diff --git a/nx-X11/programs/Xserver/hw/nxagent/Clipboard.c b/nx-X11/programs/Xserver/hw/nxagent/Clipboard.c index ecc3f19be..7ca22ffad 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/Clipboard.c +++ b/nx-X11/programs/Xserver/hw/nxagent/Clipboard.c @@ -1188,7 +1188,7 @@ static void transferSelection(int resource) void nxagentCollectPropertyEvent(int resource) { - Atom atomReturnType; + XlibAtom atomReturnType; int resultFormat; unsigned long ulReturnItems; unsigned long ulReturnBytesLeft; diff --git a/nx-X11/programs/Xserver/hw/nxagent/Events.c b/nx-X11/programs/Xserver/hw/nxagent/Events.c index 346ee48d8..847d40918 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/Events.c +++ b/nx-X11/programs/Xserver/hw/nxagent/Events.c @@ -3924,7 +3924,7 @@ void nxagentHandleCollectPropertyEvent(XEvent *X) } else { - Atom atomReturnType; + XlibAtom atomReturnType; int resultFormat; unsigned long ulReturnItems; unsigned long ulReturnBytesLeft; @@ -3940,8 +3940,8 @@ void nxagentHandleCollectPropertyEvent(XEvent *X) if (result == True) { - Window window = nxagentPropertyRequests[resource].window; - Atom property = nxagentPropertyRequests[resource].property; + XlibWindow window = nxagentPropertyRequests[resource].window; + XlibAtom property = nxagentPropertyRequests[resource].property; nxagentImportProperty(window, property, atomReturnType, resultFormat, ulReturnItems, ulReturnBytesLeft, pszReturnData); diff --git a/nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c b/nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c index 230c9abae..3492ef473 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c +++ b/nx-X11/programs/Xserver/hw/nxagent/compext/Compext.c @@ -23,6 +23,12 @@ /* */ /**************************************************************************/ +/* + * let the types be the Xlib types by undefining _XSERVER64. This + * means, when calling the functions of this file from nxagent (where + * Agent.h has been included) you need to use/provide XlibAtom and + * XlibWindow instead of Atom and Window + */ #undef _XSERVER64 #include <sys/socket.h> diff --git a/nx-X11/programs/Xserver/hw/nxagent/compext/Compext.h b/nx-X11/programs/Xserver/hw/nxagent/compext/Compext.h index c0259a939..885d262a6 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/compext/Compext.h +++ b/nx-X11/programs/Xserver/hw/nxagent/compext/Compext.h @@ -827,19 +827,31 @@ extern int NXCollectProperty( Display* /* display */, unsigned int /* resource */, Window /* window */, +#ifdef XlibAtom + XlibAtom /* property */, +#else Atom /* property */, +#endif long /* long_offset */, long /* long_length */, Bool /* delete */, +#ifdef XlibAtom + XlibAtom /* req_type */ +#else Atom /* req_type */ #endif +#endif ); extern int NXGetCollectedProperty( #if NeedFunctionPrototypes Display* /* display */, unsigned int /* resource */, +#ifdef XlibAtom + XlibAtom* /* actual_type_return */, +#else Atom* /* actual_type_return */, +#endif int* /* actual_format_return */, unsigned long* /* nitems_return */, unsigned long* /* bytes_after_return */, -- Alioth's /home/x2go-admin/maintenancescripts/git/hooks/post-receive-email on /srv/git/code.x2go.org/nx-libs.git