fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-01-06 09:40:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

dix: avoid null ptr deref at doListFontsWithInfo

Browse source 
In the doListFontsWithInfo function in dixfonts.c, when a font alias is
encountered (err == FontNameAlias), the code saves the current state
and allocates memory for c->savedName.

If the malloc(namelen + 1) call fails, c->savedName remains NULL,
but c->haveSaved is still set to TRUE. Later, when a font is
successfully resolved (err == Successful), the code uses c->savedName
without checking if it is NULL, so there is potential null ptr
dereference. XNFalloc will check result of malloc and stop
program execution if allocation was failed.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1842
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit dd5c2595a4)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2076>
This commit is contained in:
Mikhail Dmitrichenko 2025-09-17 17:25:40 +03:00 • committed by Olivier Fourdan
parent 902e4d6b8d
commit 3eeebac6d5
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
dix/dixfonts.c
View file

@ -929,9 +929,8 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
c->haveSaved = TRUE;
c->savedNumFonts = numFonts;
free(c->savedName);
c->savedName = malloc(namelen + 1);
if (c->savedName)
memcpy(c->savedName, name, namelen + 1);
c->savedName = XNFalloc(namelen + 1);
memcpy(c->savedName, name, namelen + 1);
aliascount = 20;
}
memmove(c->current.pattern, name, namelen);