[client] spice: validate clipboard responses

This commit is contained in:
Geoffrey McRae
2026-07-28 13:08:16 +10:00
parent e73a3dec60
commit e4658b4263
3 changed files with 32 additions and 15 deletions

View File

@@ -563,6 +563,9 @@ static const struct wl_data_source_listener dataSourceListener = {
static void waylandCBReplyFn(void * opaque, LG_ClipboardData type, static void waylandCBReplyFn(void * opaque, LG_ClipboardData type,
uint8_t * data, uint32_t size) uint8_t * data, uint32_t size)
{ {
if (type == LG_CLIPBOARD_DATA_NONE)
return;
struct WCBTransfer * transfer = malloc(sizeof(*transfer)); struct WCBTransfer * transfer = malloc(sizeof(*transfer));
if (!transfer) if (!transfer)
{ {

View File

@@ -135,6 +135,9 @@ static void x11CBReplyFn(void * opaque, LG_ClipboardData type,
{ {
XEvent *s = (XEvent *)opaque; XEvent *s = (XEvent *)opaque;
if (type == LG_CLIPBOARD_DATA_NONE)
s->xselection.property = None;
else
XChangeProperty( XChangeProperty(
x11.display , x11.display ,
s->xselection.requestor, s->xselection.requestor,

View File

@@ -71,6 +71,21 @@ void cb_spiceData(const PSDataType type, uint8_t * buffer, uint32_t size)
if (!g_params.clipboardToLocal) if (!g_params.clipboardToLocal)
return; return;
struct CBRequest * cbr;
if (!ll_shift(g_state.cbRequestList, (void **)&cbr))
{
DEBUG_ERROR("Received unsolicited SPICE clipboard data");
return;
}
if (type != cbr->type || (size && !buffer))
{
DEBUG_ERROR("Invalid SPICE clipboard response");
cbr->replyFn(cbr->opaque, LG_CLIPBOARD_DATA_NONE, NULL, 0);
free(cbr);
return;
}
if (type == SPICE_DATA_TEXT) if (type == SPICE_DATA_TEXT)
{ {
// dos2unix // dos2unix
@@ -89,12 +104,8 @@ void cb_spiceData(const PSDataType type, uint8_t * buffer, uint32_t size)
size = newSize; size = newSize;
} }
struct CBRequest * cbr;
if (ll_shift(g_state.cbRequestList, (void **)&cbr))
{
cbr->replyFn(cbr->opaque, cb_spiceTypeToLGType(type), buffer, size); cbr->replyFn(cbr->opaque, cb_spiceTypeToLGType(type), buffer, size);
free(cbr); free(cbr);
}
} }
void cb_spiceRelease(void) void cb_spiceRelease(void)