* fhandler_clipboard.cc (fhandler_dev_clipboard::read): Fix buffer

	read access overrun when pos > 0.

diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 1b2562bfac8a1b45c72ffec96bea657aa6d1f4f5..7c2f442e52fe1ce569f2a8c1d1ade84d907c6c43 100644 (file)
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,8 @@
+2013-06-17  Corinna Vinschen  <corinna@vinschen.de>
+
+       * fhandler_clipboard.cc (fhandler_dev_clipboard::read): Fix buffer
+       read access overrun when pos > 0.
+
 2013-06-17  Corinna Vinschen  <corinna@vinschen.de>
 
        * times.cc (GetSystemTimePreciseAsFileTime): Add comment to declaration.

diff --git a/winsup/cygwin/fhandler_clipboard.cc b/winsup/cygwin/fhandler_clipboard.cc
index 1118137c140d49c2f1596e30d557c2c81942f2fe..db72b9787ae3ea975844db16de18353f31b42e50 100644 (file)
--- a/winsup/cygwin/fhandler_clipboard.cc
+++ b/winsup/cygwin/fhandler_clipboard.cc
@@ -295,7 +295,8 @@ fhandler_dev_clipboard::read (void *ptr, size_t& len)
                  != (size_t) -1
                 && (ret > conv_len
                        /* Skip separated high surrogate: */
-                    || ((buf [pos + glen - 1] & 0xFC00) == 0xD800 && glen - pos > 1)))
+                    || ((buf [glen - 1] & 0xFC00) == 0xD800
+                        && glen - pos > 1)))
             --glen;
          if (ret == (size_t) -1)
            ret = 0;

diff --git a/winsup/cygwin/release/1.7.21 b/winsup/cygwin/release/1.7.21
index 0eb3de3a49d7485a63b69e000f43d8df42f0127f..2ea267778d7d2612de3a272fdd14f574763ea6c1 100644 (file)
--- a/winsup/cygwin/release/1.7.21
+++ b/winsup/cygwin/release/1.7.21
@@ -8,3 +8,6 @@ Bug fixes:
 - Fix long-standing problem which allows to access files via ".." using an
   invalid POSIX path, for instance, `cd nonexistant/../existing_dir".
   Fixes: http://cygwin.com/ml/cygwin/2013-05/msg00222.html
+
+- Fix EFAULT when reading large clipboard.
+  Fixes: http://cygwin.com/ml/cygwin/2013-06/msg00311.html