ice-wm / icewm

IceWM releases only, see Wiki
https://github.com/ice-wm/icewm/releases
Other
289 stars 16 forks source link

strtok_r() usage in src/misc.cc may lead to infinite loop #23

Closed danfe closed 4 years ago

danfe commented 4 years ago

The following loop can go wrong on some systems because it assumes that save may not become zero again, which is not guaranteed, and may in turn lead to an infinite loop:

    while ((directory = strtok_r(save ? 0 : env, ":", &save)) != 0) {
            // we might never get out of here...
    }

Correct way is to separate the calls and directory check. Compare to the similar loop in the src/yicon.cc for example:

    for (char *tok = strtok_r(copy, ":", &save);
        tok != 0; tok = strtok_r(0, ":", &save)) {
            // here, we have a chance to catch out-of-tokens condition
    }

Here is the actual patch.

gijsbers commented 4 years ago

This affects FreeBSD, NetBSD and OpenBSD. Glibc based systems should be fine.

danfe commented 4 years ago

Yeah, it mainly affects *BSD systems, however, the underlying assumption, and thus the while()-only code, is still wrong. Thanks for fixing.