Author: manolo
Date: 2011-05-30 09:47:48 -0700 (Mon, 30 May 2011)
New Revision: 8764
Log:
Fix STR #2647: crash when copying text from firefox under X11.
Modified:
branches/branch-1.3/src/Fl_x.cxx
Modified: branches/branch-1.3/src/Fl_x.cxx
===================================================================
--- branches/branch-1.3/src/Fl_x.cxx 2011-05-30 16:08:46 UTC (rev 8763)
+++ branches/branch-1.3/src/Fl_x.cxx 2011-05-30 16:47:48 UTC (rev 8764)
@@ -945,7 +945,7 @@
// bugs in X servers, or maybe to avoid an extra round-trip to
// get the property length. I copy this here:
Atom actual; int format; unsigned long count, remaining;
- unsigned char* portion;
+ unsigned char* portion = NULL;
if (XGetWindowProperty(fl_display,
fl_xevent->xselection.requestor,
fl_xevent->xselection.property,
@@ -971,18 +971,17 @@
fl_event_time);
return true;
}
- XTextProperty text_prop;
- text_prop.value=portion;
- text_prop.format=format;
- text_prop.encoding=actual;
- text_prop.nitems=count;
- char **text_list;
- text_list = (char**)&portion;
- int bytesnew = strlen(*text_list)+1;
- buffer = (unsigned char*)realloc(buffer, bytesread+bytesnew+remaining);
- memcpy(buffer+bytesread, *text_list, bytesnew);
+ // Make sure we got something sane...
+ if ((portion == NULL) || (format != 8) || (count == 0)) {
+ if (portion) XFree(portion);
+ return true;
+ }
+ buffer = (unsigned char*)realloc(buffer, bytesread+count+remaining+1);
+ memcpy(buffer+bytesread, portion, count);
XFree(portion);
- bytesread += bytesnew - 1;
+ bytesread += count;
+ // Cannot trust data to be null terminated
+ buffer[bytesread] = '\0';
if (!remaining) break;
}
if (buffer) {
_______________________________________________
fltk-commit mailing list
[email protected]
http://lists.easysw.com/mailman/listinfo/fltk-commit
