X11: Fix segfault on malformed INCR response

The code assumed that at least some data would be received via the INCR mechanism and that, as a result, the string buffer would be allocated. Bug found by Clang static analysis.
2026-09-21 16:44:11 +00:00 · 2022-04-18 23:22:25 +02:00
parent f60547ac80
commit 23e6e8e4b7
2 changed files with 9 additions and 5 deletions
@@ -985,13 +985,16 @@ static const char* getSelectionString(Atom selection)

                if (!itemCount)
                {
-                    if (targets[i] == XA_STRING)
+                    if (string)
                    {
-                        *selectionString = convertLatin1toUTF8(string);
-                        _glfw_free(string);
+                        if (targets[i] == XA_STRING)
+                        {
+                            *selectionString = convertLatin1toUTF8(string);
+                            _glfw_free(string);
+                        }
+                        else
+                            *selectionString = string;
                    }
-                    else
-                        *selectionString = string;

                    break;
                }