summaryrefslogtreecommitdiff
path: root/src/exif_nikon.c
diff options
context:
space:
mode:
authorTobias Stoeckmann <tobias@stoeckmann.org>2017-03-23 16:45:20 +0100
committerTobias Stoeckmann <tobias@stoeckmann.org>2017-03-23 16:45:20 +0100
commitf7a547b7ef8fc8ebdeaa4c28515c9d72e592fb6d (patch)
tree62baf6cc521fba1ea04e0ac9cec40efafe3d8eee /src/exif_nikon.c
parenta0072d60705b9764970d435ec59dfc5c53158748 (diff)
Fix double-free/OOB-write while receiving IPC data
If a malicious client pretends to be the E17 window manager, it is possible to trigger an out of boundary heap write while receiving an IPC message. The length of the already received message is stored in an unsigned short, which overflows after receiving 64 KB of data. It's comparably small amount of data and therefore achievable for an attacker. When len overflows, realloc() will either be called with a small value and therefore chars will be appended out of bounds, or len + 1 will be exactly 0, in which case realloc() behaves like free(). This could be abused for a later double-free attack as it's even possible to overwrite the free information -- but this depends on the malloc implementation. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Diffstat (limited to 'src/exif_nikon.c')
0 files changed, 0 insertions, 0 deletions