Fix crash with non-nullterminated strings (reported by Øyvind Harboe)

3 files changed, 16 insertions, 6 deletions

diff --git a/hw/xwin/ChangeLog b/hw/xwin/ChangeLog
index 79d200433..08a24be3d 100644
--- a/hw/xwin/ChangeLog
+++ b/hw/xwin/ChangeLog
@@ -1,3 +1,9 @@
+2005-01-06  Alexander Gottwald  <ago at freedesktop dot org>
+
+	* winmultiwindowclass.c:
+	* winmultiwindowwm.c:
+	Fix crash with non-nullterminated strings (reported by Øyvind Harboe)
+
 2004-12-14  Alexander Gottwald  <ago at freedesktop dot org>
 
 	* InitOutput.c:
diff --git a/hw/xwin/winmultiwindowclass.c b/hw/xwin/winmultiwindowclass.c
index d369db70e..ddbbf143a 100755
--- a/hw/xwin/winmultiwindowclass.c
+++ b/hw/xwin/winmultiwindowclass.c
@@ -175,7 +175,7 @@ winMultiWindowGetWindowRole (WindowPtr pWin, char **res_role)
 	  && prop->format == 8
 	  && prop->data)
 	{
-	  len_role= strlen ((char *) prop->data);
+	  len_role= prop->size;
 
 	  (*res_role) = malloc (len_role + 1);
 
@@ -185,7 +185,8 @@ winMultiWindowGetWindowRole (WindowPtr pWin, char **res_role)
 	      return 0; 
 	    }
 
-	  strcpy ((*res_role), prop->data);
+	  strncpy ((*res_role), prop->data, len_role);
+	  (*res_role)[len_role] = 0;
 
 	  return 1;
 	}
@@ -299,7 +300,7 @@ winMultiWindowGetWMName (WindowPtr pWin, char **wmName)
 	  && prop->type == XA_STRING
 	  && prop->data)
 	{
-	  len_name = strlen ((char *) prop->data);
+	  len_name = prop->size;
 
 	  (*wmName) = malloc (len_name + 1);
 	  
@@ -309,8 +310,8 @@ winMultiWindowGetWMName (WindowPtr pWin, char **wmName)
 	      return 0;
 	    }
 
-	  /* Add one to len_name to allow copying of trailing 0 */
-	  strncpy ((*wmName), prop->data, len_name+1);
+	  strncpy ((*wmName), prop->data, len_name);
+	  (*wmName)[len_name] = 0;
 
 	  return 1;
 	}
diff --git a/hw/xwin/winmultiwindowwm.c b/hw/xwin/winmultiwindowwm.c
index 6a58ed298..032835397 100644
--- a/hw/xwin/winmultiwindowwm.c
+++ b/hw/xwin/winmultiwindowwm.c
@@ -425,7 +425,10 @@ GetWindowName (Display *pDisplay, Window iWin, char **ppName)
       /* */
       if (xtpName.value)
 	{
-	  *ppName = strdup ((char*)xtpName.value);
+	  int size = xtpName.nitems * (xtpName.format >> 3);
+	  *ppName = malloc(size + 1);
+	  strncpy(*ppName, xtpName.value, size);
+	  (*ppName)[size] = 0;
 	  XFree (xtpName.value);
 	}