sway

commit 5222e1455597c4519869c469978b7d5dce1c8a52
parent e8fbda4d21305d0e85ff57aa93fca2520437ddc0
Author: Drew DeVault <sir@cmpwn.com>
Date:   Fri, 22 Jun 2018 06:53:17 -0700

Merge pull request #2155 from ael-code/fix_output_command_failure

bugfix: avoid access after free
Diffstat:
M
sway/commands/output/background.c
 | 
21
++++++++++++++-------

1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/sway/commands/output/background.c b/sway/commands/output/background.c
@@ -3,6 +3,7 @@
 #include <strings.h>
 #include <unistd.h>
 #include <wordexp.h>
+#include <errno.h>
 #include "sway/commands.h"
 #include "sway/config.h"
 #include "log.h"
@@ -71,21 +72,27 @@ struct cmd_results *output_cmd_background(int argc, char **argv) {
 			if (conf) {
 				char *conf_path = dirname(conf);
 				src = malloc(strlen(conf_path) + strlen(src) + 2);
-				if (src) {
-					sprintf(src, "%s/%s", conf_path, p.we_wordv[0]);
-				} else {
+				if (!src) {
+					free(conf);
+					wordfree(&p);
 					wlr_log(L_ERROR,
-						"Unable to allocate background source");
+						"Unable to allocate resource: Not enough memory");
+					return cmd_results_new(CMD_FAILURE, "output",
+						"Unable to allocate resources");
 				}
+				sprintf(src, "%s/%s", conf_path, p.we_wordv[0]);
 				free(conf);
 			} else {
 				wlr_log(L_ERROR, "Unable to allocate background source");
 			}
 		}
-		if (!src || access(src, F_OK) == -1) {
+
+		if (access(src, F_OK) == -1) {
+			struct cmd_results *cmd_res = cmd_results_new(CMD_FAILURE, "output",
+				"Unable to access background file '%s': %s", src, strerror(errno));
+			free(src);
 			wordfree(&p);
-			return cmd_results_new(CMD_INVALID, "output",
-				"Background file unreadable (%s).", src);
+			return cmd_res;
 		}
 
 		output->background = strdup(src);