From 8d0fb85bbc8eb1267f934873ddee285b0eb3f5f1 Mon Sep 17 00:00:00 2001
From: Mathias Gumz <akira at fluxbox dot org>
Date: Thu, 11 Sep 2008 16:21:51 +0200
Subject: be aware of badly specified _NET_WM_ICONS

---
 src/Ewmh.cc | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/src/Ewmh.cc b/src/Ewmh.cc
index aacb2ed..14c74c6 100644
--- a/src/Ewmh.cc
+++ b/src/Ewmh.cc
@@ -109,10 +109,15 @@ void extractNetWmIcon(Atom net_wm_icon, WinClient& winclient) {
 
         // read all the icons stored in _NET_WM_ICON
         if (raw_data)
-                XFree(raw_data);
-        winclient.property(net_wm_icon, 0L, nr_icon_data, False, XA_CARDINAL,
+            XFree(raw_data);
+
+        // something went wrong
+        if (!winclient.property(net_wm_icon, 0L, nr_icon_data, False, XA_CARDINAL,
                            &rtype, &rfmt, &nr_read, &nr_bytes_left,
-                           reinterpret_cast<unsigned char**>(&raw_data));
+                           reinterpret_cast<unsigned char**>(&raw_data))) {
+
+            return;
+        }
     }
 
     IconContainer icon_data; // stores all available data, sorted by size (width x height)
@@ -121,11 +126,19 @@ void extractNetWmIcon(Atom net_wm_icon, WinClient& winclient) {
 
     // analyze the available icons
     long i;
-    for (i = 0; i < nr_icon_data; i += width * height ) {
+
+    for (i = 0; i + 2 < nr_icon_data; i += width * height ) {
 
         width = raw_data[i++];
         height = raw_data[i++];
 
+        // strange values stored in the NETWM_ICON
+        if (width <= 0 || height <= 0 || i + width * height > nr_icon_data) {
+            std::cerr << "Ewmh.cc extractNetWmIcon found strange _NET_WM_ICON dimensions for " << winclient.title() << "\n";
+            XFree(raw_data);
+            return;
+        }
+
         icon_data[Size(width, height)] = &raw_data[i];
     }
 
-- 
cgit v0.11.2