diff options
| author | Ran Benita <ran234@gmail.com> | 2012-09-17 14:24:38 +0300 |
|---|---|---|
| committer | Ran Benita <ran234@gmail.com> | 2012-09-17 14:30:16 +0300 |
| commit | ac872bdfc286e9464a04b77c724829dd206e11a7 (patch) | |
| tree | 49b992042f02983d32d2922e9a5500c62c2a2070 /test | |
| parent | dbd7a95359652032466cadad8d8749c9ed1bfbfa (diff) | |
symbols: fix buffer overflow with illegal explicit group
Trying ''./test/interactive -l us:5' causes us to crash.
The <layout>:<N> syntax says to put this layout at the N'th level.
However the code (inherited from xkbcomp) doesn't check that the group
is valid, and then happily indexes keyi->groups with it, which has a
static size of XKB_NUM_GROUPS (the SetExplicitGroup function assumes the
index is valid). So any value a user might put there > 4 makes nice
things happen.
Signed-off-by: Ran Benita <ran234@gmail.com>
Diffstat (limited to 'test')
| -rw-r--r-- | test/rulescomp.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/test/rulescomp.c b/test/rulescomp.c index 5457d00..3fb8a30 100644 --- a/test/rulescomp.c +++ b/test/rulescomp.c @@ -107,6 +107,9 @@ int main(int argc, char *argv[]) assert(test_rmlvo(ctx, "evdev", "pc105", "us", "intl", "")); assert(test_rmlvo(ctx, "evdev", "evdev", "us", "intl", "grp:alts_toggle")); + /* 20 is not a legal group; make sure this is handled gracefully. */ + assert(test_rmlvo(ctx, "evdev", "", "us:20", "", "")); + assert(test_rmlvo(ctx, "", "", "", "", "")); assert(test_rmlvo(ctx, NULL, NULL, NULL, NULL, NULL)); |