summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLubomir Rintel <lkundrak@v3.sk>2013-11-16 13:31:03 (GMT)
committerKristian Høgsberg <krh@bitplanet.net>2013-11-22 06:01:48 (GMT)
commit360dca517a8ae58f9709420b0570b4e36a1ffa3f (patch)
treea9262e3d758b560fc1a635ede803f8b64a9133cb
parent40d057f2c90eaeffd6185078b25a0e0ff861f2a8 (diff)
downloadwayland-360dca517a8ae58f9709420b0570b4e36a1ffa3f.tar.gz
wayland-360dca517a8ae58f9709420b0570b4e36a1ffa3f.tar.xz
connection: Error out if file descriptor was not received
Otherwise the tail of fds_in buffer would just shift beyond the beginning. That confuses the actual request handler and results in a crash further on due to corrupted tail. Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
-rw-r--r--src/connection.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/src/connection.c b/src/connection.c
index 451b93e..1d8b61b 100644
--- a/src/connection.c
+++ b/src/connection.c
@@ -744,6 +744,15 @@ wl_connection_demarshal(struct wl_connection *connection,
p = next;
break;
case 'h':
+ if (connection->fds_in.tail == connection->fds_in.head) {
+ printf("file descriptor expected, "
+ "object (%d), message %s(%s)\n",
+ closure->sender_id, message->name,
+ message->signature);
+ errno = EINVAL;
+ goto err;
+ }
+
wl_buffer_copy(&connection->fds_in, &fd, sizeof fd);
connection->fds_in.tail += sizeof fd;
closure->args[i].h = fd;