Repository navigation
Fix memory bugs in the GTK login, warn when gst-plugins-good is missing - #498
Open
leifrossau wants to merge 1 commit into
Open
leifrossau wants to merge 1 commit into
leifrossau wants to merge 1 commit into
Conversation
oauth2_gtk.c: - uri_get_host() allocated len bytes and then wrote host[len], a one byte heap overflow. Allocate len+1 and use memcpy; use size_t for the offsets. - web_view_load_failed_tls() passed a possibly NULL host to strncmp() and never freed it. - the default case of the TLS error switch snprintf()ed into the uninitialized pointer 'reason'. Use a stack buffer. Without gst-plugins-good (GStreamer's autoaudiosink), WebKitGTK's web process breaks while loading the Microsoft login page and the number to enter in the Microsoft Authenticator app is never shown, which looks like a hanging login. Log a warning before opening the login window if autoaudiosink is missing, and depend on gst-plugins-good in the deb and rpm packages. Also, when the login window is closed or no code was returned, say so and point to 'onedriver -n' (log in using the normal web browser) instead of failing later with an obscure token endpoint error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
uri_get_hostmallocslenbytes and then writeshost[len](heap overflow by one byte).hosttostrncmpand never frees it.snprintf()s into an uninitializedchar *reason.autoaudiosinkelement (package gst-plugins-good), WebKitGTK's web process breaks while loading the Microsoft login page, and the Microsoft Authenticator number-matching code never appears, so the login looks like it hangs. I hit this on Arch; installing gst-plugins-good fixed it.Fix
autoaudiosinkis missing (checked withgst-inspect-1.0 --exists, skipped silently if that tool isn't installed), and depend on the plugins in the packages:gstreamer1-plugins-good(rpm),gstreamer1.0-plugins-good(deb).onedriver -nwhen no code was returned.Testing
Extra unit test for
uri_get_hostedge cases. The login flow was tested manually only.go build ./...andgo vet ./...pass.Notes
The Arch PKGBUILD isn't in this repo; it would need
gst-plugins-goodtoo.🤖 Generated with Claude Code