xkb: Fix buffer overflow in XkbChangeTypesOfKey()

If XkbChangeTypesOfKey() is called with nGroups == 0, it will resize the
key syms to 0 but leave the key actions unchanged.

If later, the same function is called with a non-zero value for nGroups,
this will cause a buffer overflow because the key actions are of the wrong
size.

To avoid the issue, make sure to resize both the key syms and key actions
when nGroups is 0.

(cherry picked from xorg/xserver@0e4ed94952)

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/279>
This commit is contained in:
Olivier Fourdan 2024-11-28 14:09:04 +01:00 committed by Alan Coopersmith
parent 865fd56aeb
commit 5f8077b257

View file

@ -694,6 +694,7 @@ XkbChangeTypesOfKey(XkbDescPtr xkb,
i = XkbSetNumGroups(i, 0);
xkb->map->key_sym_map[key].group_info = i;
XkbResizeKeySyms(xkb, key, 0);
XkbResizeKeyActions(xkb, key, 0);
return Success;
}