jh163888/xrdp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

sesman: fix potential buffer over flow

Browse Source
This commit is contained in:
Koichiro IWAO 2018-06-15 14:10:25 +09:00
parent 9192e95c96
commit 6e16b38ecc
No known key found for this signature in database
GPG Key ID: 9F72CDBC01BF10EB
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sesman/config.c
View File

@ -105,6 +105,7 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
struct list *param_v) struct list *param_v)
{ {
int i; int i;
int length;
char *buf; char *buf;
list_clear(param_v); list_clear(param_v);
@ -180,11 +181,11 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
g_free(cf->default_wm); g_free(cf->default_wm);
cf->default_wm = g_strdup("startwm.sh"); cf->default_wm = g_strdup("startwm.sh");
} }
/* if default_wm doesn't begin with '/', it's a relative path to XRDP_CFG_PATH */
/* if default_wm doesn't begin with '/', it's a relative path from XRDP_CFG_PATH */
if (cf->default_wm[0] != '/') if (cf->default_wm[0] != '/')
{ {
buf = (char *)g_malloc(1024, 0); length = sizeof(XRDP_CFG_PATH) + g_strlen(g_cfg->default_wm) + 1; /* '/' */
buf = (char *)g_malloc(length, 0);
g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, g_cfg->default_wm); g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, g_cfg->default_wm);
g_free(g_cfg->default_wm); g_free(g_cfg->default_wm);
g_cfg->default_wm = g_strdup(buf); g_cfg->default_wm = g_strdup(buf);
@ -200,16 +201,17 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
g_free(cf->reconnect_sh); g_free(cf->reconnect_sh);
cf->reconnect_sh = g_strdup("reconnectwm.sh"); cf->reconnect_sh = g_strdup("reconnectwm.sh");
} }
/* if reconnect_sh doesn't begin with '/', it's a relative path to XRDP_CFG_PATH */
if (cf->reconnect_sh[0] != '/') if (cf->reconnect_sh[0] != '/')
{ {
buf = (char *)g_malloc(1024, 0); length = sizeof(XRDP_CFG_PATH) + g_strlen(g_cfg->reconnect_sh) + 1; /* '/' */
buf = (char *)g_malloc(length, 0);
g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, g_cfg->reconnect_sh); g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, g_cfg->reconnect_sh);
g_free(g_cfg->reconnect_sh); g_free(g_cfg->reconnect_sh);
g_cfg->reconnect_sh = g_strdup(buf); g_cfg->reconnect_sh = g_strdup(buf);
g_free(buf); g_free(buf);
} }
return 0; return 0;
} }