diff options
| author | Jeremy Huddleston Sequoia <jeremyhu@apple.com> | 2015-10-18 23:03:23 -0700 |
|---|---|---|
| committer | Jeremy Huddleston Sequoia <jeremyhu@apple.com> | 2015-10-19 09:05:54 -0700 |
| commit | 3db7e332d374bf8cee581c31b7d50d7ac0509187 (patch) | |
| tree | 991738aaf30cebaf058adfe4d4348ceeb2bb827e | |
| parent | ec6294116cc41ff1c3be081b626952fb7e614244 (diff) | |
XQuartz: Make sure that darwin_all_modifier_mask_additions is 0-terminated
Found by ASan
X.Org X Server 1.17.99.901 Build Date: 20151018
================================================================
==40471==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000101fed7a4 at pc 0x000101584030 bp 0x70000029f920 sp 0x70000029f918
READ of size 4 at 0x000101fed7a4 thread T7
#0 0x10158402f in DarwinEQInit darwinEvents.c:377
#1 0x10157f3bc in InitInput darwin.c:566
#2 0x101be87ad in dix_main main.c:268
#3 0x10159131b in server_thread quartzStartup.c:66
#4 0x7fff8a535c12 in _pthread_body (/usr/lib/system/libsystem_pthread.dylib+0x3c12)
#5 0x7fff8a535b8f in _pthread_start (/usr/lib/system/libsystem_pthread.dylib+0x3b8f)
#6 0x7fff8a533374 in thread_start (/usr/lib/system/libsystem_pthread.dylib+0x1374)
0x000101fed7a4 is located 0 bytes to the right of global variable 'darwin_all_modifier_mask_additions' defined in 'darwinEvents.c:181:12'
(0x101fed7a0) of size 4
SUMMARY: AddressSanitizer: global-buffer-overflow darwinEvents.c:377 DarwinEQInit
Shadow bytes around the buggy address:
0x1000203fdaa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000203fdab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000203fdac0: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
0x1000203fdad0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
0x1000203fdae0: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9
=>0x1000203fdaf0: f9 f9 f9 f9[04]f9 f9 f9 f9 f9 f9 f9 00 00 00 00
0x1000203fdb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000203fdb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000203fdb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000203fdb30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000203fdb40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Thread T7 created by T0 here:
#0 0x10242ee99 in wrap_pthread_create
(/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x37e99)
#1 0x101591089 in create_thread quartzStartup.c:78
#2 0x101590ed9 in QuartzInitServer quartzStartup.c:95
#3 0x1015697eb in X11ApplicationMain X11Application.m:1277
#4 0x101575dc0 in X11ControllerMain X11Controller.m:984
#5 0x10159171a in server_main quartzStartup.c:127
#6 0x101540fc0 in do_start_x11_server bundle-main.c:436
#7 0x101544869 in _Xstart_x11_server mach_startupServer.c:189
#8 0x101545c96 in mach_startup_server mach_startupServer.c:398
#9 0x7fff8d1b70f3 in mach_msg_server (/usr/lib/system/libsystem_kernel.dylib+0x110f3)
#10 0x1015416e7 in main bundle-main.c:774
#11 0x7fff8bd975ac in start (/usr/lib/system/libdyld.dylib+0x35ac)
#12 0x0 (<unknown module>)
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
| -rw-r--r-- | hw/xquartz/darwinEvents.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/xquartz/darwinEvents.c b/hw/xquartz/darwinEvents.c index 9bf2f14ee..0c8e7c4b3 100644 --- a/hw/xquartz/darwinEvents.c +++ b/hw/xquartz/darwinEvents.c @@ -178,7 +178,7 @@ static int darwin_x11_modifier_mask_list[] = { 0 }; -static int darwin_all_modifier_mask_additions[] = { NX_SECONDARYFNMASK, }; +static int darwin_all_modifier_mask_additions[] = { NX_SECONDARYFNMASK, 0 }; static void DarwinUpdateModifiers(int pressed, // KeyPress or KeyRelease |