summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* xauth 1.1.1xauth-1.1.1Alan Coopersmith2021-11-281-1/+1
| | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Fix spelling/wording issuesAlan Coopersmith2021-11-285-8/+8
| | | | | | | Found by using: codespell --builtin clear,rare,usage,informal,code,names Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Fix segfault when X startsAlex Gendin2021-08-023-4/+7
| | | | | | | | | | | | | | This patch potentially fixes bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884934 System log entries when this bug occurs: kernel: xauth[16729]: segfault at 1 ip 00007f51f517f5a5 sp 00007ffdec846568 error 4 in libc-2.31.so[7f51f5102000+144000] kernel: Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 8f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8 11 0f This bug happens when function get_address_info() in gethost.c is called with a display name without forward slash, for example 'myhost.mydomain:0'
* Check malloc calls in process.cKarol Herbst2021-04-221-0/+13
| | | | | | | | | Fixes warnings like warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL 'authdata' where non-null expected Found-by: gcc static analysis Signed-off-by: Karol Herbst <kherbst@redhat.com>
* Additionally check socket file with S_ISSOCKDr. Tilmann Bubeck2020-08-201-2/+2
| | | | This fixes bug https://bugzilla.redhat.com/show_bug.cgi?id=1870201
* Avoid memory leaks in error paths in do_generateAlan Coopersmith2020-05-101-13/+23
| | | | | | | | | | | | | | | | | | Reported by Oracle Parfait: Error: Memory leak Memory leak [memory-leak] (CWE 401): Memory leak of pointer authdata allocated with malloc((authdatalen - 1)) at line 1955 of process.c in function 'do_generate'. authdata allocated at line 1946 with malloc((authdatalen - 1)) Memory leak of pointer authdata allocated with malloc((authdatalen - 1)) at line 1971 of process.c in function 'do_generate'. authdata allocated at line 1946 with malloc((authdatalen - 1)) authdata leaks when (i + 1) >= argc at line 1910. at line 1980 of process.c in function 'do_generate'. authdata allocated at line 1946 with malloc((authdatalen - 1)) authdata leaks when (i + 1) >= argc at line 1910. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Use reallocarray() when adding members to array in split_into_words()Alan Coopersmith2020-05-102-2/+15
| | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Avoid memory leak when realloc() fails in split_into_words()Alan Coopersmith2020-05-101-2/+8
| | | | | | | | | | | | Reported by Oracle Parfait: Error: Memory leak Memory leak [memory-leak] (CWE 401): Memory leak of pointer argv allocated with malloc(32) at line 283 of process.c in function 'split_into_words'. argv allocated at line 264 with malloc(32) argv leaks when cur == total at line 280. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Prevent OOB write with long file names.Tobias Stoeckmann2020-05-101-1/+5
| | | | | | | | | | If an -f argument is exactly 1022 characters in size, an off-by-one stack overflow happens in auth_finalize. The overflow could be even larger if locks are ignored for authentication files. Make sure that a given authentication file name fits into temporary buffer and that this buffer matches buffer sizes of libXau which is used by xauth.
* Fix segmentation fault on invalid add argument.Tobias Stoeckmann2020-05-031-1/+1
| | | | | | | | | | | | | | | | The hex key supplied with an add command can be quoted, in which case the quotation marks are removed. The check itself makes sure that a given string starts with a double quotation mark and ends with a double quotation mark. Buf if only " is supplied, the code crashes because it subtracts 2 from the length (which is 1) and therefore copies too much memory into a 0 allocated memory area. Proof of concept: $ xauth add :0 0 \"
* xauth 1.1xauth-1.1Adam Jackson2019-07-111-1/+1
|
* process: Close a window where no authority file would existAdam Jackson2019-06-201-11/+3
| | | | | | | | | unlink()ing the old auth file before link()ing the temp to the new is just silly. rename() is atomic and will happily clobber the destination, and the only thing link() can give you here is the ability to fail on filesystems that don't support hardlinks. Fixes: xorg/app/xauth#2
* Sort entries from most specific to most generic.Michal Srb2019-06-091-0/+41
| | | | | | | | | | | | | | | | There is no point in adding entry or merging lists if a FamilyWild entry would end in front of any entry, or entry without display number would end in front of entry with number. This sorts all entries in order: * FamilyWild without display number * FamilyWild with display number * Other family without display number * Other family with display number The order of the entries in each category is kept. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Merge only entries with equal dpy and protoname.Michal Srb2019-06-091-15/+10
| | | | | | | | | | | | | | | | | | | | | Merging two lists, or adding entry a into list acts unexpectedly if the list contains FamilyWild or entry with an empty display numbers. For example: > xauth list #ffff#6f70656e737573652d74756d626c6577656564#: MIT-MAGIC-COOKIE-1 1500d80327733252cc42ba469138a259 > xauth add test/unix:2 MIT-MAGIC-COOKIE-1 aabbccddeeff00112233445566778899 > xauth list test/unix:2 MIT-MAGIC-COOKIE-1 aabbccddeeff00112233445566778899 This is because merge_entries compares entries using `match_auth`, which follows the same rules as XauGetBestAuthByAddr. Following these rules is good when filtering the output of `xauth list`, but for merging we should compare for equality. It used to be done that way before commit 1555fff4. That commit changed it to improve the `xauth list` behavior, but did not seem consider the impact on merge. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Update configure.ac bug URL for gitlab migrationAlan Coopersmith2018-11-211-1/+1
| | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Update README for gitlab migrationAlan Coopersmith2018-11-162-24/+20
| | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Change fall through comment in process.c to match gcc's requirementsAlan Coopersmith2018-05-051-1/+1
| | | | | | | | | | | | | | | | Needs to match one of the regexps shown under https://gcc.gnu.org/onlinedocs/gcc-7.3.0/gcc/Warning-Options.html#index-Wimplicit-fallthrough Silences warning from gcc 7.3: process.c: In function ‘dump_entry’: process.c:1007:9: warning: this statement may fall through [-Wimplicit-fallthrough=] if (dpyname) { ^ process.c:1012:4: note: here default: ^~~~~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* xauth 1.0.10xauth-1.0.10Matt Turner2017-01-291-1/+1
| | | | Signed-off-by: Matt Turner <mattst88@gmail.com>
* Build xauth before running tests.Matt Turner2017-01-291-1/+1
| | | | | | Otherwise make check fails if make hasn't previously been run. Signed-off-by: Matt Turner <mattst88@gmail.com>
* autogen: add default patch prefixMihail Konev2017-01-261-0/+3
| | | | Signed-off-by: Mihail Konev <k.mvc@ya.ru>
* autogen.sh: use quoted string variablesEmil Velikov2017-01-261-4/+4
| | | | | | | | | Place quotes around the $srcdir, $ORIGDIR and $0 variables to prevent fall-outs, when they contain space. Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* autogen.sh: use exec instead of waiting for configure to finishPeter Hutterer2017-01-261-1/+1
| | | | | | | Syncs the invocation of configure with the one from the server. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
* autogen.sh: Honor NOCONFIGURE=1Alan Coopersmith2017-01-261-2/+3
| | | | | | See http://people.gnome.org/~walters/docs/build-api.txt Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* autogen.sh: stop using maintainer modePeter Hutterer2017-01-262-2/+1
| | | | | | See xserver commit 4bf3eac5fe20f Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* usage(): Print summary for the -n optionSøren Sandmann Pedersen2015-05-151-0/+1
| | | | | | | This option is mentioned in the man page, but not in the help text Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* include POSIX-standard limits.h for PATH_MAX instead of sys/syslimits.hAlan Coopersmith2015-01-052-2/+2
| | | | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com> Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
* Fix !HAVE_STRLCPY caseJon TURNEY2015-01-052-2/+2
| | | | | | | | | | | | | | | Fix error in the !HAVE_STRLCPY case, introduced in commit f990dd936b5fd1a40290bb88cde517a0ac38f823 It seems that "path[sizeof(path) - 1]" rather than "buf[sizeof(path) - 1]" must be meant here, especially as the second instance doesn't even compile... parsedpy.c: In function ‘parse_displayname’: parsedpy.c:176:9: error: ‘buf’ undeclared (first use in this function) Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* Update DISPLAY parsing to work with new launchd paths in YosemiteJeremy Huddleston Sequoia2014-12-312-20/+74
| | | | Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* Fix for xauth failing on ENOSPC (= disk full)Dr. Tilmann Bubeck2014-06-241-1/+4
| | | | | | | | | | | If xauth must store its XAUTHORITY file on a file system which is full, it will be unable to write the changes. This condition was not detected and therefore often the whole XAUTHORITY file was cleared. Here is the fix. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=21260 Signed-off-by: Dr. Tilmann Bubeck <tilmann@bubecks.de>
* Clarified RELEASING in READMEDr. Tilmann Bubeck2014-04-021-10/+7
| | | | | | Changed clone URL and improved text. Removed section GARBAGE. Signed-off-by: Dr. Tilmann Bubeck <tilmann@bubecks.de>
* Third version bump to 1.0.9.xauth-1.0.9Dr. Tilmann Bubeck2014-04-021-0/+7
| | | | | | | Minor change in README to include 1.0.9 in diff so that release.sh is happy. Signed-off-by: Dr. Tilmann Bubeck <tilmann@bubecks.de>
* Second version bump to 1.0.9.Dr. Tilmann Bubeck2014-04-021-2/+2
| | | | | | Minor change in README to push the version bump. Signed-off-by: Dr. Tilmann Bubeck <tilmann@bubecks.de>
* Fixed missing EXTRA_DIST in tests. Extended README for releasing.Dr. Tilmann Bubeck2014-04-022-0/+34
| | | | | | | | | | The tests/Makefile.am missed the EXTRA_DIST definition which resulted in missing files for the test done with "make check". This was fixed. README was extended to describe howto release a new version of this software and to clarify something from ReleaseHOWTO of x.org. Prepare anything for releasing 1.0.9. Signed-off-by: Dr. Tilmann Bubeck <tilmann@bubecks.de>
* version bump to 1.0.9Dr. Tilmann Bubeck2014-03-311-1/+1
| | | | | | Prepare for a new version 1.0.9 of xauth. Signed-off-by: Dr. Tilmann Bubeck <t.bubeck@reinform.de>
* Add AC_USE_SYSTEM_EXTENSIONS to expose non-standard extensionsAlan Coopersmith2013-12-301-0/+5
| | | | | | | | | | | | | | | | | | Required on Solaris to expose definitions in system headers that are not defined in the XPG standards now that xtrans 1.3 defines _XOPEN_SOURCE to 600 on Solaris. Fixes build failures: gethost.c: In function ‘get_hostname’: gethost.c:97:21: error: ‘INET6_ADDRSTRLEN’ undeclared (first use in this function) gethost.c:97:21: note: each undeclared identifier is reported only once for each function it appears in gethost.c:97:16: warning: unused variable ‘addr’ [-Wunused-variable] gethost.c: In function ‘get_address_info’: gethost.c:196:9: error: implicit declaration of function ‘strlcpy’ [-Werror=implicit-function-declaration] gethost.c:196:9: warning: nested extern declaration of ‘strlcpy’ [-Wnested-externs] Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Daniel Stone <daniel@fooishbar.org>
* Fix warning about warn_unused_result triggered by WRITES.Dr. Tilmann Bubeck2013-10-131-2/+3
|
* * Do not install test_xauth during "make install" as it isDr. Tilmann Bubeck2013-10-132-1/+5
| | | | | only used during "make check". * perror out, if test_xauth does not find "cmdtest".
* Second version bump to 1.0.8xauth-1.0.8Dr. Tilmann Bubeck2013-10-091-1/+1
|
* Rewrote test_xauth to C to make automake and "make distclean" happy.Dr. Tilmann Bubeck2013-10-093-3/+8
|
* Revert version bump back to 1.0.7 to prepare missing commit before 1.0.8Dr. Tilmann Bubeck2013-10-091-1/+1
|
* version bump to 1.0.8Dr. Tilmann Bubeck2013-10-081-1/+1
|
* Improved README to explain "make check".Dr. Tilmann Bubeck2013-10-081-0/+12
|
* Added command "version" and command line arg "-V" to show version of xauth.Dr. Tilmann Bubeck2013-10-083-3/+26
|
* Fix warning raised by "-Wshadow".Dr. Tilmann Bubeck2013-10-061-4/+4
|
* Rework match_auth_dpy() to be easier to read and maintain (hopefully).Dr. Tilmann Bubeck2013-10-061-8/+24
|
* Make matching algorithm mimic XauGet*AuthByAddrEgbert Eich2013-10-061-5/+9
| | | | | | | | | | Xlib (xcb) uses XauGetBestAuthByAddr() when looking for an authorization. 'xauth [n]list $DISPLAY' used a slightly stricter algorithm which doesn't find a possible authorization for cases where either the family is set to FamilyWild or address the address length is 0. Signed-off-by: Egbert Eich <eich@freedesktop.org>
* Added black box tests for basic functionality started with "make check".Dr. Tilmann Bubeck2013-10-0616-1/+243
|
* Handle v4-mapped inet6 addresses correctlyEgbert Eich2013-10-011-10/+16
| | | | | | | | | | | | | Handling of v4-mapped inet6 addresses has been introduced with commit 58140dbbd39389ad6af58e201e055f3d4b92d368: Look for FamilyLocal if inet or inet6 address is loopback These adresses should be treated as inet addresses. This patch makes the code consistent with the handling if xcb_auth.c in libxcb. Signed-off-by: Egbert Eich <eich@freedesktop.org>
* Look for FamilyLocal if inet or inet6 address is loopbackEgbert Eich2013-09-291-5/+35
| | | | | | | | | | | | | | libxcb uses FamilyLocal authorization if the host name or IP in the display string is from the loopback device. This patch adds the same behavior to xauth. This fixes a long standing problem that for ssh tunneled connections a display variable of the form: localhost:<N>.<M> leads to correct authorization when an X client is started but "xauth list $DISPLAY" returns nothing. Signed-off-by: Egbert Eich <eich@freedesktop.org> Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com> Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* Silenece lack of noreturn warningJeremy Huddleston Sequoia2013-09-293-1/+4
| | | | Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
View Lorry Controller Status