Wayland wl_connection_demarshal() Out-Of-Bounds Memory Access

Wayland: out-of-bounds memory access in wlconnectiondemarshal on 32-bit systems In wlconnectiondemarshal, incoming strings are parsed as follows: // audit note: length is a u32 // audit note: p points to raw incoming u32 length = p++; if length == 0 closure-argsi.s = NULL; break; // audit note:...