fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-20 12:50:04 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix XChangeFeedbackControl() request underflow

Browse source 
CVE-2021-3472 / ZDI-CAN-1259

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit 7aaf54a188)
This commit is contained in:
Matthieu Herrb 2021-04-13 15:55:41 +02:00 • committed by Michel Dänzer
parent 2a327e5860
commit 1e4bf85df1
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Xi/chgfctl.c
View file

@ -464,8 +464,11 @@ ProcXChangeFeedbackControl(ClientPtr client)
break; break;
case StringFeedbackClass: case StringFeedbackClass:
{ {
xStringFeedbackCtl *f = ((xStringFeedbackCtl *) &stuff[1]); xStringFeedbackCtl *f;
REQUEST_AT_LEAST_EXTRA_SIZE(xChangeFeedbackControlReq,
sizeof(xStringFeedbackCtl));
f = ((xStringFeedbackCtl *) &stuff[1]);
if (client->swapped) { if (client->swapped) {
if (len < bytes_to_int32(sizeof(xStringFeedbackCtl))) if (len < bytes_to_int32(sizeof(xStringFeedbackCtl)))
return BadLength; return BadLength;