Bug Summary

File:src/SetHints.c
Location:line 223, column 14
Description:String copy function overflows destination buffer

Annotated Source Code

1
2/***********************************************************
3
4Copyright 1987, 1998 The Open Group
5
6Permission to use, copy, modify, distribute, and sell this software and its
7documentation for any purpose is hereby granted without fee, provided that
8the above copyright notice appear in all copies and that both that
9copyright notice and this permission notice appear in supporting
10documentation.
11
12The above copyright notice and this permission notice shall be included in
13all copies or substantial portions of the Software.
14
15THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
19AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
20CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
21
22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group.
25
26
27Copyright 1987 by Digital Equipment Corporation, Maynard, Massachusetts.
28
29 All Rights Reserved
30
31Permission to use, copy, modify, and distribute this software and its
32documentation for any purpose and without fee is hereby granted,
33provided that the above copyright notice appear in all copies and that
34both that copyright notice and this permission notice appear in
35supporting documentation, and that the name of Digital not be
36used in advertising or publicity pertaining to distribution of the
37software without specific, written prior permission.
38
39DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
40ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
41DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
42ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
43WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
44ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
45SOFTWARE.
46
47******************************************************************/
48
49#ifdef HAVE_CONFIG_H1
50#include <config.h>
51#endif
52#include <X11/Xlibint.h>
53#include <X11/Xutil.h>
54#include "Xatomtype.h"
55#include <X11/Xatom.h>
56#include <X11/Xos.h>
57
58#define safestrlen(s)((s) ? strlen(s) : 0) ((s) ? strlen(s) : 0)
59
60int
61XSetSizeHints( /* old routine */
62 Display *dpy,
63 Window w,
64 XSizeHints *hints,
65 Atom property)
66{
67 xPropSizeHints prop;
68 memset(&prop, 0, sizeof(prop))__builtin___memset_chk (&prop, 0, sizeof(prop), __builtin_object_size
(&prop, 0))
;
69 prop.flags = (hints->flags & (USPosition(1L << 0)|USSize(1L << 1)|PAllHints((1L << 2)|(1L << 3)|(1L << 4)|(1L <<
5)|(1L << 6)|(1L << 7))
));
70 if (hints->flags & (USPosition(1L << 0)|PPosition(1L << 2))) {
71 prop.x = hints->x;
72 prop.y = hints->y;
73 }
74 if (hints->flags & (USSize(1L << 1)|PSize(1L << 3))) {
75 prop.width = hints->width;
76 prop.height = hints->height;
77 }
78 if (hints->flags & PMinSize(1L << 4)) {
79 prop.minWidth = hints->min_width;
80 prop.minHeight = hints->min_height;
81 }
82 if (hints->flags & PMaxSize(1L << 5)) {
83 prop.maxWidth = hints->max_width;
84 prop.maxHeight = hints->max_height;
85 }
86 if (hints->flags & PResizeInc(1L << 6)) {
87 prop.widthInc = hints->width_inc;
88 prop.heightInc = hints->height_inc;
89 }
90 if (hints->flags & PAspect(1L << 7)) {
91 prop.minAspectX = hints->min_aspect.x;
92 prop.minAspectY = hints->min_aspect.y;
93 prop.maxAspectX = hints->max_aspect.x;
94 prop.maxAspectY = hints->max_aspect.y;
95 }
96 return XChangeProperty (dpy, w, property, XA_WM_SIZE_HINTS((Atom) 41), 32,
97 PropModeReplace0, (unsigned char *) &prop,
98 OldNumPropSizeElements15);
99}
100
101/*
102 * XSetWMHints sets the property
103 * WM_HINTS type: WM_HINTS format:32
104 */
105
106int
107XSetWMHints (
108 Display *dpy,
109 Window w,
110 XWMHints *wmhints)
111{
112 xPropWMHints prop;
113 memset(&prop, 0, sizeof(prop))__builtin___memset_chk (&prop, 0, sizeof(prop), __builtin_object_size
(&prop, 0))
;
114 prop.flags = wmhints->flags;
115 if (wmhints->flags & InputHint(1L << 0))
116 prop.input = (wmhints->input == True1 ? 1 : 0);
117 if (wmhints->flags & StateHint(1L << 1))
118 prop.initialState = wmhints->initial_state;
119 if (wmhints->flags & IconPixmapHint(1L << 2))
120 prop.iconPixmap = wmhints->icon_pixmap;
121 if (wmhints->flags & IconWindowHint(1L << 3))
122 prop.iconWindow = wmhints->icon_window;
123 if (wmhints->flags & IconPositionHint(1L << 4)) {
124 prop.iconX = wmhints->icon_x;
125 prop.iconY = wmhints->icon_y;
126 }
127 if (wmhints->flags & IconMaskHint(1L << 5))
128 prop.iconMask = wmhints->icon_mask;
129 if (wmhints->flags & WindowGroupHint(1L << 6))
130 prop.windowGroup = wmhints->window_group;
131 return XChangeProperty (dpy, w, XA_WM_HINTS((Atom) 35), XA_WM_HINTS((Atom) 35), 32,
132 PropModeReplace0, (unsigned char *) &prop,
133 NumPropWMHintsElements9);
134}
135
136
137
138/*
139 * XSetZoomHints sets the property
140 * WM_ZOOM_HINTS type: WM_SIZE_HINTS format: 32
141 */
142
143int
144XSetZoomHints (
145 Display *dpy,
146 Window w,
147 XSizeHints *zhints)
148{
149 return XSetSizeHints (dpy, w, zhints, XA_WM_ZOOM_HINTS((Atom) 42));
150}
151
152
153/*
154 * XSetNormalHints sets the property
155 * WM_NORMAL_HINTS type: WM_SIZE_HINTS format: 32
156 */
157
158int
159XSetNormalHints ( /* old routine */
160 Display *dpy,
161 Window w,
162 XSizeHints *hints)
163{
164 return XSetSizeHints (dpy, w, hints, XA_WM_NORMAL_HINTS((Atom) 40));
165}
166
167
168
169/*
170 * Note, the following is one of the few cases were we really do want sizeof
171 * when examining a protocol structure. This is because the XChangeProperty
172 * routine will take care of converting to host to network data structures.
173 */
174
175int
176XSetIconSizes (
177 Display *dpy,
178 Window w, /* typically, root */
179 XIconSize *list,
180 int count) /* number of items on the list */
181{
182 register int i;
183 xPropIconSize *pp, *prop;
184#define size_of_the_real_thing sizeof /* avoid grepping screwups */
185 unsigned nbytes = count * size_of_the_real_thing(xPropIconSize);
186#undef size_of_the_real_thing
187 if ((prop = pp = Xmalloc (nbytes)malloc(((nbytes) == 0 ? 1 : (nbytes))))) {
188 for (i = 0; i < count; i++) {
189 pp->minWidth = list->min_width;
190 pp->minHeight = list->min_height;
191 pp->maxWidth = list->max_width;
192 pp->maxHeight = list->max_height;
193 pp->widthInc = list->width_inc;
194 pp->heightInc = list->height_inc;
195 pp += 1;
196 list += 1;
197 }
198 XChangeProperty (dpy, w, XA_WM_ICON_SIZE((Atom) 38), XA_WM_ICON_SIZE((Atom) 38), 32,
199 PropModeReplace0, (unsigned char *) prop,
200 count * NumPropIconSizeElements6);
201 Xfree (prop)free((prop));
202 }
203 return 1;
204}
205
206int
207XSetCommand (
208 Display *dpy,
209 Window w,
210 char **argv,
211 int argc)
212{
213 register int i;
214 register int nbytes;
215 register char *buf, *bp;
216 for (i = 0, nbytes = 0; i < argc; i++) {
10
Assuming 'i' is < 'argc'
11
Loop condition is true. Entering loop body
12
Assuming 'i' is < 'argc'
13
Loop condition is true. Entering loop body
14
Assuming 'i' is >= 'argc'
15
Loop condition is false. Execution continues on line 219
217 nbytes += safestrlen(argv[i])((argv[i]) ? strlen(argv[i]) : 0) + 1;
218 }
219 if ((bp = buf = Xmalloc(nbytes)malloc(((nbytes) == 0 ? 1 : (nbytes))))) {
16
Assuming 'bp' is not null
17
Taking true branch
220 /* copy arguments into single buffer */
221 for (i = 0; i < argc; i++) {
18
Loop condition is true. Entering loop body
20
Loop condition is true. Entering loop body
222 if (argv[i]) {
19
Taking true branch
21
Taking true branch
223 (void) strcpy(bp, argv[i])__builtin___strcpy_chk (bp, argv[i], __builtin_object_size (bp
, 2 > 1 ? 1 : 0))
;
22
Within the expansion of the macro 'strcpy':
a
String copy function overflows destination buffer
224 bp += strlen(argv[i]) + 1;
225 }
226 else
227 *bp++ = '\0';
228 }
229 XChangeProperty (dpy, w, XA_WM_COMMAND((Atom) 34), XA_STRING((Atom) 31), 8,
230 PropModeReplace0, (unsigned char *)buf, nbytes);
231 Xfree(buf)free((buf));
232 }
233 return 1;
234}
235/*
236 * XSetStandardProperties sets the following properties:
237 * WM_NAME type: STRING format: 8
238 * WM_ICON_NAME type: STRING format: 8
239 * WM_HINTS type: WM_HINTS format: 32
240 * WM_COMMAND type: STRING
241 * WM_NORMAL_HINTS type: WM_SIZE_HINTS format: 32
242 */
243
244int
245XSetStandardProperties (
246 Display *dpy,
247 Window w, /* window to decorate */
248 _Xconstconst char *name, /* name of application */
249 _Xconstconst char *icon_string,/* name string for icon */
250 Pixmap icon_pixmap, /* pixmap to use as icon, or None */
251 char **argv, /* command to be used to restart application */
252 int argc, /* count of arguments */
253 XSizeHints *hints) /* size hints for window in its normal state */
254{
255 XWMHints phints;
256 phints.flags = 0;
257
258 if (name != NULL((void*)0)) XStoreName (dpy, w, name);
1
Assuming 'name' is equal to null
2
Taking false branch
259
260 if (icon_string != NULL((void*)0)) {
3
Assuming 'icon_string' is equal to null
4
Taking false branch
261 XChangeProperty (dpy, w, XA_WM_ICON_NAME((Atom) 37), XA_STRING((Atom) 31), 8,
262 PropModeReplace0,
263 (_Xconstconst unsigned char *)icon_string,
264 safestrlen(icon_string)((icon_string) ? strlen(icon_string) : 0));
265 }
266
267 if (icon_pixmap != None0L) {
5
Assuming 'icon_pixmap' is equal to 0
6
Taking false branch
268 phints.icon_pixmap = icon_pixmap;
269 phints.flags |= IconPixmapHint(1L << 2);
270 }
271 if (argv != NULL((void*)0)) XSetCommand(dpy, w, argv, argc);
7
Assuming 'argv' is not equal to null
8
Taking true branch
9
Calling 'XSetCommand'
272
273 if (hints != NULL((void*)0)) XSetNormalHints(dpy, w, hints);
274
275 if (phints.flags != 0) XSetWMHints(dpy, w, &phints);
276
277 return 1;
278}
279
280int
281XSetTransientForHint(
282 Display *dpy,
283 Window w,
284 Window propWindow)
285{
286 return XChangeProperty(dpy, w, XA_WM_TRANSIENT_FOR((Atom) 68), XA_WINDOW((Atom) 33), 32,
287 PropModeReplace0, (unsigned char *) &propWindow, 1);
288}
289
290int
291XSetClassHint(
292 Display *dpy,
293 Window w,
294 XClassHint *classhint)
295{
296 char *class_string;
297 char *s;
298 int len_nm, len_cl;
299
300 len_nm = safestrlen(classhint->res_name)((classhint->res_name) ? strlen(classhint->res_name) : 0
)
;
301 len_cl = safestrlen(classhint->res_class)((classhint->res_class) ? strlen(classhint->res_class) :
0)
;
302 if ((class_string = s = Xmalloc(len_nm + len_cl + 2)malloc(((len_nm + len_cl + 2) == 0 ? 1 : (len_nm + len_cl + 2
)))
)) {
303 if (len_nm) {
304 strcpy(s, classhint->res_name)__builtin___strcpy_chk (s, classhint->res_name, __builtin_object_size
(s, 2 > 1 ? 1 : 0))
;
305 s += len_nm + 1;
306 }
307 else
308 *s++ = '\0';
309 if (len_cl)
310 strcpy(s, classhint->res_class)__builtin___strcpy_chk (s, classhint->res_class, __builtin_object_size
(s, 2 > 1 ? 1 : 0))
;
311 else
312 *s = '\0';
313 XChangeProperty(dpy, w, XA_WM_CLASS((Atom) 67), XA_STRING((Atom) 31), 8,
314 PropModeReplace0, (unsigned char *) class_string,
315 len_nm+len_cl+2);
316 Xfree(class_string)free((class_string));
317 }
318 return 1;
319}