fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-27 05:50:06 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Xi: check for invalid modifiers for XI2 passive grabs

Browse source 
The other values are checked correctly, but if a modifier was outside the
allowed range, it would go unnoticed and cause a out-of-bounds read error for
any mask equal or larger than 256. The DetailRec where we store the grab masks
is only sized to 8 * sizeof(Mask).

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 0f10cfd4b9)
This commit is contained in:
Peter Hutterer 2014-02-20 13:18:05 +10:00
parent b3656c0b52
commit 2cbbe80efc
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Xi/exevents.c
View file

@ -2183,7 +2183,8 @@ CheckGrabValues(ClientPtr client, GrabParameters *param)
return BadValue;
}
if (param->grabtype != XI2 && (param->modifiers != AnyModifier) &&
if (param->modifiers != AnyModifier &&
param->modifiers != XIAnyModifier &&
(param->modifiers & ~AllModifiersMask)) {
client->errorValue = param->modifiers;
return BadValue;

4
Xi/xipassivegrab.c
View file

@ -189,6 +189,10 @@ ProcXIPassiveGrabDevice(ClientPtr client)
uint8_t status = Success;
param.modifiers = *modifiers;
ret = CheckGrabValues(client, &param);
if (ret != Success)
goto out;
switch (stuff->grab_type) {
case XIGrabtypeButton:
status = GrabButton(client, dev, mod_dev, stuff->detail,