rust-x-bindings / xkbcommon-rs

bindings and safe wrappers for libxkbcommon
MIT License
20 stars 24 forks source link

Out of bounds memory read in `key_get_utf8` #55

Closed ConradIrwin closed 3 months ago

ConradIrwin commented 4 months ago

Fix is here: #54

The bounds checking in this function is incorrect, and so (if the C library ever returned a value > 64 and < than the amount of available memory) this function would let you read uninitialized memory.

In the case of the bug I've seen in zed, I suspect that we only ever saw values that were negative, which are so large when cast to usize that the program just terminated instead.