fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-20 07:00:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Xi: ProcXIPassiveGrabDevice needs to use unswapped length to send reply

Browse source 
CVE-2024-31081

Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 3e77295f88)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1464>
This commit is contained in:
Alan Coopersmith 2024-03-22 18:56:27 -07:00
parent bd16cc8368
commit 672b26d1f8
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Xi/xipassivegrab.c
View file

@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
GrabParameters param;
void *tmp;
int mask_len;
uint32_t length;
REQUEST(xXIPassiveGrabDeviceReq);
REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client)
}
}
/* save the value before SRepXIPassiveGrabDevice swaps it */
length = rep.length;
WriteReplyToClient(client, sizeof(rep), &rep);
if (rep.num_modifiers)
WriteToClient(client, rep.length * 4, modifiers_failed);
WriteToClient(client, length * 4, modifiers_failed);
out:
free(modifiers_failed);