fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-26 21:40:05 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Xi: allocate enough XkbActions for our buttons

Browse source 
button->xkb_acts is supposed to be an array sufficiently large for all
our buttons, not just a single XkbActions struct. Allocating
insufficient memory here means when we memcpy() later in
XkbSetDeviceInfo we write into memory that wasn't ours to begin with,
leading to the usual security ooopsiedaisies.

CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

(cherry picked from commit 0c1a93d319)
This commit is contained in:
Peter Hutterer 2023-11-28 15:19:04 +10:00
parent aaf854fb25
commit 19e9f19995
2 changed files with 16 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
Xi/exevents.c
View file

@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
}
if (from->button->xkb_acts) {
if (!to->button->xkb_acts) {
to->button->xkb_acts = calloc(1, sizeof(XkbAction));
if (!to->button->xkb_acts)
FatalError("[Xi] not enough memory for xkb_acts.\n");
}
size_t maxbuttons = max(to->button->numButtons, from->button->numButtons);
to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts,
maxbuttons,
sizeof(XkbAction));
memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction));
memcpy(to->button->xkb_acts, from->button->xkb_acts,
sizeof(XkbAction));
from->button->numButtons * sizeof(XkbAction));
}
else {
free(to->button->xkb_acts);

10
dix/devices.c
View file

@ -2530,6 +2530,8 @@ RecalculateMasterButtons(DeviceIntPtr slave)
if (master->button && master->button->numButtons != maxbuttons) {
int i;
int last_num_buttons = master->button->numButtons;
DeviceChangedEvent event = {
.header = ET_Internal,
.type = ET_DeviceChanged,
@ -2540,6 +2542,14 @@ RecalculateMasterButtons(DeviceIntPtr slave)
};
master->button->numButtons = maxbuttons;
if (last_num_buttons < maxbuttons) {
master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts,
maxbuttons,
sizeof(XkbAction));
memset(&master->button->xkb_acts[last_num_buttons],
0,
(maxbuttons - last_num_buttons) * sizeof(XkbAction));
}
memcpy(&event.buttons.names, master->button->labels, maxbuttons *
sizeof(Atom));