Fix config buffer overflow and logic

1 files changed, 19 insertions, 12 deletions

diff --git a/sway/config.c b/sway/config.c
index 636f5f57..b8c874e6 100644
--- a/sway/config.c
+++ b/sway/config.c
@@ -560,8 +560,8 @@ static char *expand_line(const char *block, const char *line, bool add_brace) {
 
 bool read_config(FILE *file, struct sway_config *config) {
 	bool reading_main_config = false;
-	char *this_config = NULL, *config_pos;
-	long config_size = 0;
+	char *this_config = NULL;
+	unsigned long config_size = 0;
 	if (config->current_config == NULL) {
 		reading_main_config = true;
 
@@ -569,7 +569,7 @@ bool read_config(FILE *file, struct sway_config *config) {
 		config_size = ftell(file);
 		rewind(file);
 
-		config_pos = this_config = malloc(config_size + 1);
+		config->current_config = this_config = calloc(1, config_size + 1);
 		if (this_config == NULL) {
 			wlr_log(WLR_ERROR, "Unable to allocate buffer for config contents");
 			return false;
@@ -580,6 +580,7 @@ bool read_config(FILE *file, struct sway_config *config) {
 	int line_number = 0;
 	char *line;
 	list_t *stack = create_list();
+	size_t read = 0;
 	while (!feof(file)) {
 		char *block = stack->length ? stack->items[0] : NULL;
 		line = read_line(file);
@@ -590,10 +591,21 @@ bool read_config(FILE *file, struct sway_config *config) {
 		wlr_log(WLR_DEBUG, "Read line %d: %s", line_number, line);
 
 		if (reading_main_config) {
-			size_t l = strlen(line);
-			memcpy(config_pos, line, l); // don't copy terminating character
-			config_pos += l;
-			*config_pos++ = '\n';
+			size_t length = strlen(line);
+
+			if (read + length > config_size) {
+				wlr_log(WLR_ERROR, "Config file changed during reading");
+				list_foreach(stack, free);
+				list_free(stack);
+				free(line);
+				return false;
+			}
+
+			strcpy(this_config + read, line);
+			if (line_number != 1) {
+				this_config[read - 1] = '\n';
+			}
+			read += length + 1;
 		}
 
 		line = strip_whitespace(line);
@@ -616,7 +628,6 @@ bool read_config(FILE *file, struct sway_config *config) {
 			list_foreach(stack, free);
 			list_free(stack);
 			free(line);
-			free(this_config);
 			return false;
 		}
 		wlr_log(WLR_DEBUG, "Expanded line: %s", expanded);
@@ -677,10 +688,6 @@ bool read_config(FILE *file, struct sway_config *config) {
 	list_foreach(stack, free);
 	list_free(stack);
 
-	if (reading_main_config) {
-		this_config[config_size - 1] = '\0';
-		config->current_config = this_config;
-	}
 	return success;
 }