summaryrefslogtreecommitdiff
path: root/process.c
AgeCommit message (Collapse)AuthorFilesLines
2022-09-11Handle -Wempty-body warning for WRITES() macroAlan Coopersmith1-1/+1
process.c:659:57: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] #define WRITES(fd, S) {if(write((fd), (S), strlen((S))));} ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-09-11Remove unnecessary casts from malloc() callsAlan Coopersmith1-4/+4
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-09-11Variable scope reductions, as suggested by cppcheckAlan Coopersmith1-55/+50
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-04-10Fix off-by-one in quote-stripping routinesAlan Coopersmith1-2/+2
Reported by Oracle Parfait: Error: Buffer overrun Buffer overflow [buffer-overflow] (CWE 120): In pointer dereference of key[(len - 1)] with index (len - 1) Array size >= 1 bytes, index >= 1 at line 1647 of process.c in function 'do_add'. Error: Buffer overrun Buffer overflow [buffer-overflow] (CWE 120): In pointer dereference of authdata[(authdatalen - 1)] with index (authdatalen - 1) Array size is ??? bytes, index is ??? at line 1965 of process.c in function 'do_generate'. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2021-11-28Fix spelling/wording issuesAlan Coopersmith1-3/+3
Found by using: codespell --builtin clear,rare,usage,informal,code,names Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2021-08-02Fix segfault when X startsAlex Gendin1-0/+2
This patch potentially fixes bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884934 System log entries when this bug occurs: kernel: xauth[16729]: segfault at 1 ip 00007f51f517f5a5 sp 00007ffdec846568 error 4 in libc-2.31.so[7f51f5102000+144000] kernel: Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 8f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8 11 0f This bug happens when function get_address_info() in gethost.c is called with a display name without forward slash, for example 'myhost.mydomain:0'
2021-04-22Check malloc calls in process.cKarol Herbst1-0/+13
Fixes warnings like warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL 'authdata' where non-null expected Found-by: gcc static analysis Signed-off-by: Karol Herbst <kherbst@redhat.com>
2020-05-10Avoid memory leaks in error paths in do_generateAlan Coopersmith1-13/+23
Reported by Oracle Parfait: Error: Memory leak Memory leak [memory-leak] (CWE 401): Memory leak of pointer authdata allocated with malloc((authdatalen - 1)) at line 1955 of process.c in function 'do_generate'. authdata allocated at line 1946 with malloc((authdatalen - 1)) Memory leak of pointer authdata allocated with malloc((authdatalen - 1)) at line 1971 of process.c in function 'do_generate'. authdata allocated at line 1946 with malloc((authdatalen - 1)) authdata leaks when (i + 1) >= argc at line 1910. at line 1980 of process.c in function 'do_generate'. authdata allocated at line 1946 with malloc((authdatalen - 1)) authdata leaks when (i + 1) >= argc at line 1910. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2020-05-10Use reallocarray() when adding members to array in split_into_words()Alan Coopersmith1-1/+14
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2020-05-10Avoid memory leak when realloc() fails in split_into_words()Alan Coopersmith1-2/+8
Reported by Oracle Parfait: Error: Memory leak Memory leak [memory-leak] (CWE 401): Memory leak of pointer argv allocated with malloc(32) at line 283 of process.c in function 'split_into_words'. argv allocated at line 264 with malloc(32) argv leaks when cur == total at line 280. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2020-05-10Prevent OOB write with long file names.Tobias Stoeckmann1-1/+5
If an -f argument is exactly 1022 characters in size, an off-by-one stack overflow happens in auth_finalize. The overflow could be even larger if locks are ignored for authentication files. Make sure that a given authentication file name fits into temporary buffer and that this buffer matches buffer sizes of libXau which is used by xauth.
2020-05-03Fix segmentation fault on invalid add argument.Tobias Stoeckmann1-1/+1
The hex key supplied with an add command can be quoted, in which case the quotation marks are removed. The check itself makes sure that a given string starts with a double quotation mark and ends with a double quotation mark. Buf if only " is supplied, the code crashes because it subtracts 2 from the length (which is 1) and therefore copies too much memory into a 0 allocated memory area. Proof of concept: $ xauth add :0 0 \"
2019-06-20process: Close a window where no authority file would existAdam Jackson1-11/+3
unlink()ing the old auth file before link()ing the temp to the new is just silly. rename() is atomic and will happily clobber the destination, and the only thing link() can give you here is the ability to fail on filesystems that don't support hardlinks. Fixes: xorg/app/xauth#2
2019-06-09Sort entries from most specific to most generic.Michal Srb1-0/+41
There is no point in adding entry or merging lists if a FamilyWild entry would end in front of any entry, or entry without display number would end in front of entry with number. This sorts all entries in order: * FamilyWild without display number * FamilyWild with display number * Other family without display number * Other family with display number The order of the entries in each category is kept. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2019-06-09Merge only entries with equal dpy and protoname.Michal Srb1-15/+10
Merging two lists, or adding entry a into list acts unexpectedly if the list contains FamilyWild or entry with an empty display numbers. For example: > xauth list #ffff#6f70656e737573652d74756d626c6577656564#: MIT-MAGIC-COOKIE-1 1500d80327733252cc42ba469138a259 > xauth add test/unix:2 MIT-MAGIC-COOKIE-1 aabbccddeeff00112233445566778899 > xauth list test/unix:2 MIT-MAGIC-COOKIE-1 aabbccddeeff00112233445566778899 This is because merge_entries compares entries using `match_auth`, which follows the same rules as XauGetBestAuthByAddr. Following these rules is good when filtering the output of `xauth list`, but for merging we should compare for equality. It used to be done that way before commit 1555fff4. That commit changed it to improve the `xauth list` behavior, but did not seem consider the impact on merge. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2018-05-05Change fall through comment in process.c to match gcc's requirementsAlan Coopersmith1-1/+1
Needs to match one of the regexps shown under https://gcc.gnu.org/onlinedocs/gcc-7.3.0/gcc/Warning-Options.html#index-Wimplicit-fallthrough Silences warning from gcc 7.3: process.c: In function ‘dump_entry’: process.c:1007:9: warning: this statement may fall through [-Wimplicit-fallthrough=] if (dpyname) { ^ process.c:1012:4: note: here default: ^~~~~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-06-24Fix for xauth failing on ENOSPC (= disk full)Dr. Tilmann Bubeck1-1/+4
If xauth must store its XAUTHORITY file on a file system which is full, it will be unable to write the changes. This condition was not detected and therefore often the whole XAUTHORITY file was cleared. Here is the fix. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=21260 Signed-off-by: Dr. Tilmann Bubeck <tilmann@bubecks.de>
2013-10-13Fix warning about warn_unused_result triggered by WRITES.Dr. Tilmann Bubeck1-2/+3
2013-10-08Added command "version" and command line arg "-V" to show version of xauth.Dr. Tilmann Bubeck1-0/+14
2013-10-06Fix warning raised by "-Wshadow".Dr. Tilmann Bubeck1-4/+4
2013-10-06Rework match_auth_dpy() to be easier to read and maintain (hopefully).Dr. Tilmann Bubeck1-8/+24
2013-10-06Make matching algorithm mimic XauGet*AuthByAddrEgbert Eich1-5/+9
Xlib (xcb) uses XauGetBestAuthByAddr() when looking for an authorization. 'xauth [n]list $DISPLAY' used a slightly stricter algorithm which doesn't find a possible authorization for cases where either the family is set to FamilyWild or address the address length is 0. Signed-off-by: Egbert Eich <eich@freedesktop.org>
2013-09-29Silenece lack of noreturn warningJeremy Huddleston Sequoia1-0/+2
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
2013-09-24Fix various compiler warnings raised by modern gcc (4.8.1).Dr. Tilmann Bubeck1-8/+9
2013-09-24Use copystring to create non-const string.]Thomas Klausner1-1/+1
Hello! I see you're the official xauth maintainer according to http://cgit.freedesktop.org/xorg/doc/xorg-docs/tree/MAINTAINERS#n80 Can you please take a look at the attached patch and merge it? Thanks, Thomas ----- Forwarded message from Thomas Klausner <wiz@NetBSD.org> ----- Date: Sun, 30 Jun 2013 13:29:44 +0200 From: Thomas Klausner <wiz@NetBSD.org> To: xorg-devel@lists.x.org Cc: Thomas Klausner <wiz@NetBSD.org> Subject: [PATCH:xauth] Use copystring to create non-const string. Fixes "error: assignment discards qualifiers from pointer target type" Signed-off-by: Thomas Klausner <wiz@NetBSD.org>
2013-09-23Don't crash when running past the end of the chainEgbert Eich1-2/+5
Running past the end of the chain would cause a SEGV. Signed-off-by: Egbert Eich <eich@freedesktop.org>
2013-02-23Assume signal handlers return void, as C89 requiresAlan Coopersmith1-8/+2
Drops use of autoconf's obsolete AC_TYPE_SIGNAL and Imake's even more obsolete SIGNALRETURNSINT. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2012-11-05Include Xwinsock.h rather than sys/socket.h on WIN32Jon TURNEY1-0/+4
For AF_INET6, include Xwinsock.h rather than sys/socket.h on WIN32 Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk> Reviewed-by: Yaakov Selkowitz <yselkowitz@users.sourceforge.net>
2011-09-28Add const attributes to fix gcc -Wwrite-strings warningsAlan Coopersmith1-77/+79
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-09-28Strip trailing whitespaceAlan Coopersmith1-106/+106
Performed with: find * -type f | xargs perl -i -p -e 's{[ \t]+$}{}' git diff -w & git diff -b show no diffs from this change Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-09-28convert strlen/malloc/strcpy combo to strdupAlan Coopersmith1-4/+2
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-05-23auth_finalize: Attempt to rename() if link() failsJeremy Huddleston1-1/+2
On some file systems (like AFP), hard links are not supported. If link fails, try rename() before giving up. Reported-by: Jamie Kennea <jamie@pompey.org> Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-05-06Error out and avoid a call to malloc(0) if given a bad hex stringJeremy Huddleston1-2/+2
process.c:567:14: warning: Call to 'malloc' has an allocation size of 0 bytes retval = malloc (len); ^ ~~~ 1 warning generated. Found-by: clang static analyzer Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
2010-10-06Purge cvs tags.Jesse Adkins1-3/+0
Signed-off-by: Jesse Adkins <jesserayadkins@gmail.com>
2010-08-25launchd: Properly support launchd sockets in xauthJeremy Huddleston1-3/+0
What we had in place before was a hack that always used ':0'. This change results in the bundle id being used to differentiate different connections. Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
2009-10-09Bug 7051: xauth says creating new authority file even though it does notAlan Coopersmith1-1/+1
https://bugs.freedesktop.org/show_bug.cgi?id=7051 Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
2009-07-19Initialize ed.used_stdout at the beginning of do_extract()Matthieu Herrb1-0/+1
This avoids reading uninitialized memory later. Problem reported by Philip Guenther. Thanks. Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
2009-03-07Fix format errorMichael Scherer1-1/+1
2007-12-01Added support for launchd socketJeremy Huddleston1-0/+3
From Martin Costabel
2006-12-11Remove Imake compatibility #ifdefs - require configure's AC_TYPE_SIGNALAlan Coopersmith1-11/+2
2005-07-26Add config.h includes for modularization Use RETSIGTYPE if defined byXORG-6_8_99_901XORG-6_8_99_900Alan Coopersmith1-1/+9
autoconf in addition to Imake's SIGNALRETURNSINT.
2004-04-24Bugzilla #550: xauth doesn't unlock .Xauthority on SIGPIPEsco_port_update-baserel-0-6-1lg3d-rel-0-7-0lg3d-rel-0-6-2lg3d-baseXORG-6_8_99_9XORG-6_8_99_8XORG-6_8_99_7XORG-6_8_99_6XORG-6_8_99_5XORG-6_8_99_4XORG-6_8_99_3XORG-6_8_99_2XORG-6_8_99_16XORG-6_8_99_15XORG-6_8_99_14XORG-6_8_99_13XORG-6_8_99_12XORG-6_8_99_11XORG-6_8_99_10XORG-6_8_99_1XORG-6_8_2XORG-6_8_1_904XORG-6_8_1_903XORG-6_8_1_902XORG-6_8_1_901XORG-6_8_1XORG-6_8_0XORG-6_7_99_904XORG-6_7_99_903XORG-6_7_99_902XORG-6_7_99_901XORG-6_7_99_2XORG-6_7_99_1XACE-SELINUX-MERGEXORG-6_8-branchAlan Coopersmith1-0/+4
2004-04-23Merging XORG-CURRENT into trunkEgbert Eich1-1/+1
2004-03-14Importing vendor version xf86-4_4_99_1 on Sun Mar 14 00:26:39 PST 2004xf86-4_4_99_1Egbert Eich1-1/+1
2004-03-03Importing vendor version xf86-4_4_0 on Wed Mar 3 04:09:24 PST 2004xf86-4_4_0Egbert Eich1-1/+1
2004-02-26readding XFree86's cvs IDsxf86-4_3_99_903Egbert Eich1-1/+1
2004-02-26Importing vendor version xf86-4_3_99_903 on Wed Feb 26 01:21:00 PST 2004Egbert Eich1-1/+1
2004-01-29Importing vendor version xf86-012804-2330 on Thu Jan 29 00:06:33 PST 2004xf86-4_3_99_903_specialxf86-012804-2330Egbert Eich1-4/+78
2003-12-04XFree86 4.3.99.901 (RC 1)xf86-4_3_99_902xf86-4_3_99_901Kaleb Keithley1-2/+3
2003-11-25XFree86 4.3.99.16 Bring the tree up to date for the Cygwin folksxf86-4_3_99_16Kaleb Keithley1-78/+102
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-24 03:10:54 +0000