Fix memory corruption (too small IPC::Message::messageData) #32
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Copying wpe_input_axis_event to IPC::Message::messageData
in the code like:
causes memory corruption as the size of messageData is 24
while the size of wpe_input_axis_event is 28 bytes.
Dump of relevant offsets:
(gdb) ptype /o IPC::Message
/* offset | size / type = struct IPC::Message {
static const size_t size;
static const size_t dataSize;
/ 0 | 8 / uint64_t messageCode;
/ 8 | 24 */ uint8_t messageData[24];
(gdb) ptype /o wpe_input_axis_event
/* offset | size / type = struct wpe_input_axis_event {
/ 0 | 4 / enum wpe_input_axis_event_type type;
/ 4 | 4 / uint32_t time;
/ 8 | 4 / int x;
/ 12 | 4 / int y;
/ 16 | 4 / uint32_t axis;
/ 20 | 4 / int32_t value;
/ 24 | 4 */ uint32_t modifiers;
Fix increases the size of messageData appropriately and adds a
static_assert() to make sure the program will not compile rather
than trying to corrupt the memory.