mirror of https://github.com/mpv-player/mpv
11d35b72a6
The size overflow check was inverted: instead of allowing reading only the first dst_size bytes of the property, it allowed copying past the property buffer (as returned by xlib). xlib doesn't return the size of the buffer in bytes, so it has to be computed and checked manually. Wouldn't it be great if C allowed me to write the overflow check in a readable way, so it doesn't trick me into writing dumb security bugs? Relying on X security is even dumber than creating a X security bug, though, so this was not a real problem. But I found that one specific call tried to read more than what the property provided, so reduce that. Also, len*ib obviously can't overflow, so there's an additional layer of dumb to this whole thing. While we're at dumb things, why the hell does xlib use "long" for 32 bit types. It's a god damn pain. |
||
|---|---|---|
| .. | ||
| cocoa | ||
| cocoa-cb | ||
| d3d11 | ||
| gpu | ||
| hwdec | ||
| opengl | ||
| placebo | ||
| vulkan | ||
| win32 | ||
| android_common.c | ||
| android_common.h | ||
| aspect.c | ||
| aspect.h | ||
| bitmap_packer.c | ||
| bitmap_packer.h | ||
| cocoa_cb_common.swift | ||
| cocoa_common.h | ||
| cocoa_common.m | ||
| d3d_shader_420p.h | ||
| d3d_shader_yuv.hlsl | ||
| dither.c | ||
| dither.h | ||
| dr_helper.c | ||
| dr_helper.h | ||
| drm_atomic.c | ||
| drm_atomic.h | ||
| drm_common.c | ||
| drm_common.h | ||
| drm_prime.c | ||
| drm_prime.h | ||
| filter_kernels.c | ||
| filter_kernels.h | ||
| libmpv.h | ||
| vo.c | ||
| vo.h | ||
| vo_caca.c | ||
| vo_direct3d.c | ||
| vo_drm.c | ||
| vo_gpu.c | ||
| vo_image.c | ||
| vo_lavc.c | ||
| vo_libmpv.c | ||
| vo_mediacodec_embed.c | ||
| vo_null.c | ||
| vo_rpi.c | ||
| vo_sdl.c | ||
| vo_tct.c | ||
| vo_vaapi.c | ||
| vo_vdpau.c | ||
| vo_wlshm.c | ||
| vo_x11.c | ||
| vo_xv.c | ||
| w32_common.c | ||
| w32_common.h | ||
| wayland_common.c | ||
| wayland_common.h | ||
| win_state.c | ||
| win_state.h | ||
| x11_common.c | ||
| x11_common.h | ||