Pull in some fixes from upstream:

o various memleak fixes
o ensure get_wm_class_from_reply returns a valid C-string

OK matthieu@, deraadt@

2 files changed, 44 insertions, 18 deletions

diff --git a/dist/libxcb/src/xcb_util.c b/dist/libxcb/src/xcb_util.c
index 996ff2518..b4b56f43b 100644
--- a/dist/libxcb/src/xcb_util.c
+++ b/dist/libxcb/src/xcb_util.c
@@ -84,35 +84,43 @@ static int _xcb_parse_display(const char *name, char **host, char **protocol,
 
     colon = strrchr(name, ':');
     if(!colon)
-        return 0;
+        goto error_out;
     len = colon - name;
     ++colon;
     display = strtoul(colon, &dot, 10);
     if(dot == colon)
-        return 0;
+        goto error_out;
     if(*dot == '\0')
         screen = 0;
     else
     {
         if(*dot != '.')
-            return 0;
+            goto error_out;
         ++dot;
         screen = strtoul(dot, &end, 10);
         if(end == dot || *end != '\0')
-            return 0;
+            goto error_out;
     }
     /* At this point, the display string is fully parsed and valid, but
      * the caller's memory is untouched. */
 
     *host = malloc(len + 1);
     if(!*host)
-        return 0;
+        goto error_out;
     memcpy(*host, name, len);
     (*host)[len] = '\0';
     *displayp = display;
     if(screenp)
         *screenp = screen;
     return 1;
+
+error_out:
+    if (protocol) {
+        free(*protocol);
+        *protocol = NULL;
+    }
+
+    return 0;
 }
 
 int xcb_parse_display(const char *name, char **host, int *displayp,
@@ -347,8 +355,8 @@ xcb_connection_t *xcb_connect(const char *displayname, int *screenp)
 xcb_connection_t *xcb_connect_to_display_with_auth_info(const char *displayname, xcb_auth_info_t *auth, int *screenp)
 {
     int fd, display = 0;
-    char *host;
-    char *protocol;
+    char *host = NULL;
+    char *protocol = NULL;
     xcb_auth_info_t ourauth;
     xcb_connection_t *c;
 
@@ -361,17 +369,21 @@ xcb_connection_t *xcb_connect_to_display_with_auth_info(const char *displayname,
         fd = _xcb_open_unix(NULL, displayname);
     else
 #endif
-    if(!parsed)
-        return (xcb_connection_t *) &error_connection;
-    else
+    if(!parsed) {
+        c = (xcb_connection_t *) &error_connection;
+        goto out;
+    } else
         fd = _xcb_open(host, protocol, display);
-    free(host);
 
-    if(fd == -1)
-        return (xcb_connection_t *) &error_connection;
+    if(fd == -1) {
+        c = (xcb_connection_t *) &error_connection;
+        goto out;
+    }
 
-    if(auth)
-        return xcb_connect_to_fd(fd, auth);
+    if(auth) {
+        c = xcb_connect_to_fd(fd, auth);
+        goto out;
+    }
 
     if(_xcb_get_auth_info(fd, &ourauth, display))
     {
@@ -382,5 +394,8 @@ xcb_connection_t *xcb_connect_to_display_with_auth_info(const char *displayname,
     else
         c = xcb_connect_to_fd(fd, 0);
 
+out:
+    free(host);
+    free(protocol);
     return c;
 }
diff --git a/dist/xcb-util/icccm/icccm.c b/dist/xcb-util/icccm/icccm.c
index 74383a05f..062b955cf 100644
--- a/dist/xcb-util/icccm/icccm.c
+++ b/dist/xcb-util/icccm/icccm.c
@@ -58,8 +58,10 @@ xcb_get_text_property_reply(xcb_connection_t *c,
 {
   xcb_get_property_reply_t *reply = xcb_get_property_reply(c, cookie, e);
 
-  if(!reply || reply->type == XCB_NONE)
+  if(!reply || reply->type == XCB_NONE) {
+    free(reply);
     return 0;
+  }
 
   prop->_reply = reply;
   prop->encoding = prop->_reply->type;
@@ -242,7 +244,7 @@ uint8_t
 xcb_get_wm_class_from_reply(xcb_get_wm_class_reply_t *prop,
                             xcb_get_property_reply_t *reply)
 {
-  int name_len;
+  int name_len, len;
 
   if(!reply || reply->type != STRING || reply->format != 8)
     return 0;
@@ -250,8 +252,17 @@ xcb_get_wm_class_from_reply(xcb_get_wm_class_reply_t *prop,
   prop->_reply = reply;
   prop->instance_name = (char *) xcb_get_property_value(prop->_reply);
 
+  len = xcb_get_property_value_length(prop->_reply);
+  /* Ensure there's a C end-of-string at the end of the property.
+     Truncate the property if necessary (the spec says there's already
+     a 0 in the last position, so this only hurts invalid props). */
+  if(len < reply->length * 4)
+    prop->instance_name[len] = 0;
+  else
+    prop->instance_name[len-1] = 0;
+
   name_len = strlen(prop->instance_name);
-  if(name_len == xcb_get_property_value_length(prop->_reply))
+  if(name_len == len)
     name_len--;
 
   prop->class_name = prop->instance_name + name_len + 1;