mirror of
https://github.com/jamesstringer90/appsandbox.git
synced 2026-10-22 19:12:42 -05:00
James Stringer
a2a3c0920a
- C10 appsandbox-clipboard.c: the host->guest INCR accumulator doubled accum_cap *before* realloc, so on realloc failure it memcpy'd into the un-enlarged buffer (heap overflow). Grow into a temp, commit the cap only on a successful realloc, and append only when the buffer has room. - L11 appsandbox-clipboard.c: reject FORMAT_LIST frames with data_size<4 before reading the 4-byte count (OOB read; Linux analog of H4/C9). - L18 appsandbox-clipboard.c: host->guest folder paste flattened — the text/uri-list builder listed every nested file and no directory, so the file manager pasted the files flat with no folder. List top-level items only (a top-level dir contributes its own URI; nested entries none), guarded on the dir actually existing. - L12 appsandbox-display.c: use-after-free reading p->plane_id after drmModeFreePlane(p) in cursor_init; log the cached cur->plane_id. - L13 appsandbox-audio.c: idle silence paced at 10ms < the ~21.3ms packet duration, overrunning the host render ring; pace at the true packet duration (FRAMES_PER_PACKET * 1000000000 / SAMPLE_RATE). Built in-VM and validated on a live Ubuntu VM (folder/sub-item paste; audio/display/clipboard daemons healthy after redeploy).