lxqt / lxqt-session

The LXQt session manager
https://lxqt.github.io
GNU Lesser General Public License v2.1
57 stars 52 forks source link

Check if wordexp succeeds before using its output #525

Closed gudzpoz closed 1 month ago

gudzpoz commented 1 month ago

When wordexp returns non-zero values, the wordexp_t output is not guaranteed to be in good shape and wordfreeing it might cause segfaults:

#include <stdio.h>
#include <stdlib.h>
#include <wordexp.h>

int main(void) {
  wordexp_t p;
  char **w;

  printf("%d\n", wordexp("wayland;fcitx;ibus", &p, 0));
  w = p.we_wordv;
  for (size_t i = 0; i < p.we_wordc; i++)
    printf("%s\n", w[i]);
  wordfree(&p); //<----------- segfaults here
  return 0;
}
$ gcc a.c
$ ./a.out
2
[1]    32922 segmentation fault (core dumped)  ./a.out

This PR checks the return value of wordexp and calls wordfree accordingly.

Reproduction Steps

  1. Open lxqt-config-session and add an enviroment variable like QT_IM_MODULES=wayland;fcitx;ibus.
  2. Check ~/.config/lxqt/session.conf for this line QT_IM_MODULES="wayland;fcitx;ibus", and note that wayland;fcitx;ibus is an invalid input string for wordexp.
  3. Run lxqt-session and observe the segfault.

Other details

lxqt-session installed from the Arch Linux repository differs from lxqt-session compiled from source (both v2.0.0):

But this PR should be able to handle both cases.

stefonarch commented 1 month ago

Can confirm the bug and that the PR is working, thanks! Tested on https://github.com/lxqt/lxqt-session/pull/523 the backtrace I got is

Message: Process 288408 (lxqt-session) of user 1004 dumped core.

                Stack trace of thread 288408:
                #0  0x00007df8f9d144a3 wordfree (libc.so.6 + 0x1054a3)
                #1  0x000060d08de88abd n/a (lxqt-session + 0x11abd)
                #2  0x000060d08de940db n/a (lxqt-session + 0x1d0db)
                #3  0x000060d08de9726f n/a (lxqt-session + 0x2026f)
                #4  0x000060d08de854ef n/a (lxqt-session + 0xe4ef)
                #5  0x00007df8f978c00f _ZN7QObject5eventEP6QEvent (libQt6Core.so.6 + 0x18c00f)
                #6  0x00007df8fa8fc51c _ZN19QApplicationPrivate13notify_helperEP7QObjectP6QEvent (libQt6Widgets.so.6 + 0xfc51c)