[X2Go-Commits] [nx-libs] 381/429: Clipboard.c: limit selection nxagentFindCurrentSelectionIndex can return

[git-admin at x2go.org]

This is an automated email from the git hooks/post-receive script.

x2go pushed a commit to branch 3.6.x
in repository nx-libs.

commit 9d8771562c847e957250f7df7411b9ce92dd1143
Author: Ulrich Sibiller <uli42 at gmx.de>
Date:   Sat Jan 30 18:39:14 2021 +0100

    Clipboard.c: limit selection nxagentFindCurrentSelectionIndex can return
    
    Normally you'd expect the loop going up to NumCurrentSelections. But
    the dix code will increase that number (but not nxagentMaxSelections)
    when drag and drop comes into play. In that case this helper will
    report a match for other selections than the ones the clipboard code
    knows about. The subsequent code will then use a higher index which
    will lead to out of range data reads (and writes!). Therefore we take
    nxagentMaxSelections here. The startup code ensures that both arrays
    will refer to the same selection for the first nxagentMaxSelections
    selection atoms.
    
    This way the clipboard code will not kick in for drag and drop
    resources.
    
    Fixes ArcticaProject/nx-libs#986
---
 nx-X11/programs/Xserver/hw/nxagent/Clipboard.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Clipboard.c b/nx-X11/programs/Xserver/hw/nxagent/Clipboard.c
index 3098ebb49..b3598eef8 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Clipboard.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Clipboard.c
@@ -763,7 +763,21 @@ int nxagentFindLastSelectionOwnerIndex(XlibAtom sel)
  */
 int nxagentFindCurrentSelectionIndex(Atom sel)
 {
-  for (int index = 0; index < NumCurrentSelections; index++)
+  /*
+   * Normally you'd expect the loop going up to
+   * NumCurrentSelections. But the dix code will increase that number
+   * (but not nxagentMaxSelections) when drag and drop comes into
+   * play. In that case this helper will report a match for other
+   * selections than the ones the clipboard code knows about. The
+   * subsequent code will then use a higher index which will be used
+   * by the clipboard code and will lead to out of range data reads
+   * (and writes!). Therefore we take nxagentMaxSelections here. The
+   * startup code ensures that both arrays will refer to the same
+   * selection for the first nxagentMaxSelections selection atoms.
+   */
+
+  //  for (int index = 0; index < NumCurrentSelections; index++)
+  for (int index = 0; index < nxagentMaxSelections; index++)
   {
     if (CurrentSelections[index].selection == sel)
     {

--
Alioth's /home/x2go-admin/maintenancescripts/git/hooks/post-receive-email on /srv/git/code.x2go.org/nx-libs.git