Skip to content

Commit fe209db

Browse files
committed
i3/sway: fix crash due to newline breaking up an IPC message
1 parent 84d6d97 commit fe209db

File tree

1 file changed

+17
-2
lines changed

1 file changed

+17
-2
lines changed

src/x11/i3/ipc/connection.cpp

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ I3Ipc::I3Ipc() {
120120

121121
void I3Ipc::eventSocketReady() {
122122
while (true) {
123-
auto rawEvent = this->liveEventSocket.readLine();
123+
auto rawEvent = this->liveEventSocket.readAll();
124124
if (rawEvent.isEmpty()) break;
125125

126126
for (auto& [type, data]: I3Ipc::parseResponse(rawEvent)) {
@@ -139,6 +139,13 @@ QVector<Event> I3Ipc::parseResponse(QByteArray rawEvent) {
139139
const int header = 8 + magicLen;
140140

141141
while (rawEvent.startsWith(MAGIC)) {
142+
auto eventLength = rawEvent.length();
143+
144+
if (eventLength < header) {
145+
qCWarning(logI3Ipc) << "Event isn't long enough to hold the header data (14 bytes).";
146+
break;
147+
};
148+
142149
QDataStream ds(QByteArray(rawEvent.data() + magicLen, 8)); // NOLINT
143150

144151
ds.setByteOrder(static_cast<QDataStream::ByteOrder>(QSysInfo::ByteOrder));
@@ -151,7 +158,15 @@ QVector<Event> I3Ipc::parseResponse(QByteArray rawEvent) {
151158

152159
if (I3IpcEvent::intToEvent(type) == EventCode::UNKNOWN) {
153160
qCWarning(logI3Ipc) << "Received unknown event" << rawEvent;
154-
return events;
161+
break;
162+
}
163+
164+
auto maxPayloadLength = eventLength - header;
165+
166+
if (maxPayloadLength < size) {
167+
qCWarning(logI3Ipc) << "Payload is smaller than length advertised in header, skipping... ("
168+
<< maxPayloadLength << "vs" << size << ")";
169+
break;
155170
}
156171

157172
auto byteData = QByteArray(rawEvent.data() + header, size); // NOLINT

0 commit comments

Comments
 (0)