[client] spice: validate clipboard responses

This commit is contained in:
Geoffrey McRae
2026-07-28 13:08:16 +10:00
parent e73a3dec60
commit e4658b4263
3 changed files with 32 additions and 15 deletions

View File

@@ -563,6 +563,9 @@ static const struct wl_data_source_listener dataSourceListener = {
static void waylandCBReplyFn(void * opaque, LG_ClipboardData type,
uint8_t * data, uint32_t size)
{
if (type == LG_CLIPBOARD_DATA_NONE)
return;
struct WCBTransfer * transfer = malloc(sizeof(*transfer));
if (!transfer)
{

View File

@@ -135,6 +135,9 @@ static void x11CBReplyFn(void * opaque, LG_ClipboardData type,
{
XEvent *s = (XEvent *)opaque;
if (type == LG_CLIPBOARD_DATA_NONE)
s->xselection.property = None;
else
XChangeProperty(
x11.display ,
s->xselection.requestor,

View File

@@ -71,6 +71,21 @@ void cb_spiceData(const PSDataType type, uint8_t * buffer, uint32_t size)
if (!g_params.clipboardToLocal)
return;
struct CBRequest * cbr;
if (!ll_shift(g_state.cbRequestList, (void **)&cbr))
{
DEBUG_ERROR("Received unsolicited SPICE clipboard data");
return;
}
if (type != cbr->type || (size && !buffer))
{
DEBUG_ERROR("Invalid SPICE clipboard response");
cbr->replyFn(cbr->opaque, LG_CLIPBOARD_DATA_NONE, NULL, 0);
free(cbr);
return;
}
if (type == SPICE_DATA_TEXT)
{
// dos2unix
@@ -89,13 +104,9 @@ void cb_spiceData(const PSDataType type, uint8_t * buffer, uint32_t size)
size = newSize;
}
struct CBRequest * cbr;
if (ll_shift(g_state.cbRequestList, (void **)&cbr))
{
cbr->replyFn(cbr->opaque, cb_spiceTypeToLGType(type), buffer, size);
free(cbr);
}
}
void cb_spiceRelease(void)
{