paolostivanin / OTPClient

Highly secure and easy to use OTP client written in C/GTK3 that supports both TOTP and HOTP
GNU General Public License v3.0
459 stars 48 forks source link

Fix symlinked db malloc bug #290

Closed ph1l closed 1 year ago

ph1l commented 1 year ago

When the db_path is a symlink, the program crashes:

mobian@mobian:~$ otpclient-cli list
Type the DB decryption password:

(process:1382): GLib-ERROR **: 01:45:25.011: ../../../glib/gmem.c:169: failed to allocate 18446744073709551586 bytes
Trace/breakpoint trap

get_file_size() was returning the size of the symlink, not the size of the linked to database. This resulted in an unsigned underrun, which presents as that enormous malloc that fails. Not sure if this G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS flag is set for a good reason, but this patch fixes the bug for me. :-)

fixes paolostivanin/OTPClient#289