tinylcy/vino

A critical bug in vn_handle_get_connection

JimLee1996 opened this issue · 1 comments

vino/src/vino.c

Lines 479 to 487 in 7027986

if ((srcfd = open(filepath, O_RDONLY, 0)) < 0) {
err_sys("[vn_handle_get_connection] open error");
}
file_size = vn_get_filesize(filepath);
/* Map the target file into memory */
if ((srcp = mmap(NULL, file_size, PROT_READ, MAP_PRIVATE, srcfd, 0)) == MAP_FAILED) {
vn_log_warn("Call mmap error, filepath = %s\n", filepath);
err_sys("[vn_handle_get_connection] mmap error");
}

If filepath points to an existing dir, accessing it will cause a crash.

image

I've tried to fix it by adding a check:

https://github.com/JimLee1996/vino/blob/ae4a220493912cc4e6d485b6903e4f80e0182430/src/vino.c#L468-L483

  1. if not exist: return
  2. if is a dir, find VN_DEFAULT_PAGE in it
  3. check file existence again