Skip to content

Commit c42ffff

Browse files
mcatanzaroaperezdc
authored andcommitted
Fix memory allocation issues in pasteboard get_types()
The get_types() implementation has two flaws. First, the use of calloc() is vulnerable to overflow if length is huge. Second, we attempt to zero the allocation, but only zero the first element by mistake. These issues were found by the Ubuntu Security Team. Thank you! (cherry picked from commit f05f59f)
1 parent c785ad5 commit c42ffff

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

src/pasteboard-generic.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,9 +51,9 @@ struct wpe_pasteboard_interface generic_pasteboard_interface = {
5151
if (!length)
5252
return;
5353

54-
out_vector->strings = static_cast<struct wpe_pasteboard_string*>(calloc(1, sizeof(struct wpe_pasteboard_string) * length));
54+
out_vector->strings = static_cast<struct wpe_pasteboard_string*>(calloc(length, sizeof(struct wpe_pasteboard_string)));
5555
out_vector->length = length;
56-
memset(out_vector->strings, 0, out_vector->length);
56+
memset(out_vector->strings, 0, sizeof(struct wpe_pasteboard_string) * length);
5757

5858
uint64_t i = 0;
5959
for (auto& entry : pasteboard)

0 commit comments

Comments
 (0)