fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-02-14 22:40:29 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

xfixes: Check request length for SetClientDisconnectMode

Browse source 
The handler of XFixesSetClientDisconnectMode does not check the client
request length.

A client could send a shorter request and read data from a former
request.

Fix the issue by checking the request size matches.

CVE-2025-49177

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Fixes: e167299f6 - xfixes: Add ClientDisconnectMode
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit ab02fb96b1)
This commit is contained in:
Olivier Fourdan 2025-04-28 10:05:36 +02:00 • committed by Alan Coopersmith
parent bfbd77a59a
commit 721d4ff4e5
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
xfixes/disconnect.c
View file

@ -67,6 +67,7 @@ ProcXFixesSetClientDisconnectMode(ClientPtr client)
ClientDisconnectPtr pDisconnect = GetClientDisconnect(client);
REQUEST(xXFixesSetClientDisconnectModeReq);
REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq);
pDisconnect->disconnect_mode = stuff->disconnect_mode;
@ -77,7 +78,7 @@ int _X_COLD
SProcXFixesSetClientDisconnectMode(ClientPtr client)
{
REQUEST(xXFixesSetClientDisconnectModeReq);
REQUEST_AT_LEAST_SIZE(xXFixesSetClientDisconnectModeReq);
REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq);
swapl(&stuff->disconnect_mode);