! Please note that this is a snapshot of our old Bugzilla server, which is read only since May 29, 2020. Please go to gitlab.xfce.org for our new server !
Crash when tooltip longer than 256 bytes is provided by command
Status:
RESOLVED: FIXED
Product:
Xfce4-genmon-plugin
Component:
General

Comments

Description Mathias Rav 2012-04-09 11:30:44 CEST
Created attachment 4309 
Change size of acToolTips from 256 to BUFMAX.

If a program outputs a tooltip longer than 256 bytes, a buffer in DisplayCmdOutput of main.c is overflowed leading to a segmentation fault.

In DisplayCmdOutput in main.c, acToolTips is a 256-byte char array to hold the tooltip provided by the external program. However, the program may provide as much as 1024 bytes of XML output (since struct genmon_t::acValue is a 1024-byte char array, a size which is passed to genmon_SpawnCmd), and the smaller buffer size isn't honored when the tooltip is extracted in DisplayCmdOutput.

Attached patch that simply changes the size of acToolTips from 256 to BUFMAX (same size used by genmon_t).
Comment 1 John Lindgren editbugs 2012-05-12 00:42:52 CEST
Fixed even better by not using fixed-length buffers at all:
http://git.xfce.org/panel-plugins/xfce4-genmon-plugin/commit/?id=1658dc71ea866fd28fa4c617cadc763260765b33

Bug #8659

Reported by:
Mathias Rav
Reported on: 2012-04-09
Last modified on: 2012-05-12

People

Assignee:
Florian Rivoal
CC List:
1 user

Version

Attachments

Additional information