diff options
| author | Giuseppe D'Angelo <giuseppe.dangelo@kdab.com> | 2014-09-20 20:12:38 +0200 |
|---|---|---|
| committer | Giuseppe D'Angelo <giuseppe.dangelo@kdab.com> | 2014-09-22 18:56:33 +0200 |
| commit | 772b799a83e72382d5594cf0eca8a01d42e4002e (patch) | |
| tree | f960d123608a005baab142a9daa8a932d015ddf5 /src/plugins/platforms/xcb/qxcbclipboard.cpp | |
| parent | ebdd56c5bd4b5115f9626561123ac740dc874ade (diff) | |
XCB: fix a possible array overflow leading to a crash
The QClipboard::Mode returned from modeForAtom should be checked
everywhere because values greater than Selection (i.e. FindBuffer)
aren't supported on X and should mean error conditions.
The lack of such a check did an out-of-bounds array access, which
could lead to a crash.
Change-Id: I70f70b5f713ab2f892e258d4df2f7afeb434f0c1
Reviewed-by: Uli Schlachter <psychon@znc.in>
Reviewed-by: Gatis Paeglis <gatis.paeglis@digia.com>
Diffstat (limited to 'src/plugins/platforms/xcb/qxcbclipboard.cpp')
| -rw-r--r-- | src/plugins/platforms/xcb/qxcbclipboard.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/plugins/platforms/xcb/qxcbclipboard.cpp b/src/plugins/platforms/xcb/qxcbclipboard.cpp index e7f8510706..a5bbefcfd1 100644 --- a/src/plugins/platforms/xcb/qxcbclipboard.cpp +++ b/src/plugins/platforms/xcb/qxcbclipboard.cpp @@ -738,6 +738,9 @@ void QXcbClipboard::handleSelectionRequest(xcb_selection_request_event_t *req) void QXcbClipboard::handleXFixesSelectionRequest(xcb_xfixes_selection_notify_event_t *event) { QClipboard::Mode mode = modeForAtom(event->selection); + if (mode > QClipboard::Selection) + return; + // here we care only about the xfixes events that come from non Qt processes if (event->owner != XCB_NONE && event->owner != owner()) { if (!m_xClipboard[mode]) { |