[gnome-settings-daemon/gnome-3-24] clipboard: Fix potential divisions by zero



commit 9c5fd3254b38ac1aae730b656af323f723c7e662
Author: Philip Withnall <withnall endlessm com>
Date:   Mon Mar 27 12:18:19 2017 +0100

    clipboard: Fix potential divisions by zero
    
    If handling an unknown format of X data, the bytes_per_item will be
    calculated as zero, which will cause a division by zero.
    
    Return early in those cases.
    
    Coverity IDs: 1418241, 1418244
    
    https://bugzilla.gnome.org/show_bug.cgi?id=780587

 plugins/clipboard/gsd-clipboard-manager.c |   17 ++++++++++++++---
 1 files changed, 14 insertions(+), 3 deletions(-)
---
diff --git a/plugins/clipboard/gsd-clipboard-manager.c b/plugins/clipboard/gsd-clipboard-manager.c
index 09d778f..64a888b 100644
--- a/plugins/clipboard/gsd-clipboard-manager.c
+++ b/plugins/clipboard/gsd-clipboard-manager.c
@@ -181,7 +181,7 @@ finish_selection_request (GsdClipboardManager *manager,
         gdk_error_trap_pop_ignored ();
 }
 
-static int
+static gsize
 clipboard_bytes_per_item (int format)
 {
         switch (format) {
@@ -367,6 +367,7 @@ send_incrementally (GsdClipboardManager *manager,
         unsigned long   length;
         unsigned long   items;
         unsigned char  *data;
+        gsize           bytes_per_item;
 
         list = list_find (manager->priv->conversions,
                           (ListFindFunc) find_conversion_requestor, xev);
@@ -375,6 +376,10 @@ send_incrementally (GsdClipboardManager *manager,
 
         rdata = (IncrConversion *) list->data;
 
+        bytes_per_item = clipboard_bytes_per_item (rdata->data->format);
+        if (bytes_per_item == 0)
+                return False;
+
         data = rdata->data->data + rdata->offset;
         length = rdata->data->length - rdata->offset;
         if (length > SELECTION_MAX_SIZE)
@@ -382,7 +387,7 @@ send_incrementally (GsdClipboardManager *manager,
 
         rdata->offset += length;
 
-        items = length / clipboard_bytes_per_item (rdata->data->format);
+        items = length / bytes_per_item;
         XChangeProperty (manager->priv->display, rdata->requestor,
                          rdata->property, rdata->data->type,
                          rdata->data->format, PropModeAppend,
@@ -521,6 +526,8 @@ convert_clipboard_target (IncrConversion      *rdata,
                                  (unsigned char *) targets, n_targets);
                 free (targets);
         } else  {
+                gsize bytes_per_item;
+
                 /* Convert from stored CLIPBOARD data */
                 list = list_find (manager->priv->contents,
                                   (ListFindFunc) find_content_target, (void *) rdata->target);
@@ -536,8 +543,12 @@ convert_clipboard_target (IncrConversion      *rdata,
                         return;
                 }
 
+                bytes_per_item = clipboard_bytes_per_item (tdata->format);
+                if (bytes_per_item == 0)
+                        return;
+
                 rdata->data = target_data_ref (tdata);
-                items = tdata->length / clipboard_bytes_per_item (tdata->format);
+                items = tdata->length / bytes_per_item;
                 if (tdata->length <= SELECTION_MAX_SIZE)
                         XChangeProperty (manager->priv->display, rdata->requestor,
                                          rdata->property,


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]