fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-20 04:40:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

xfixes: Check request length for SetClientDisconnectMode

Browse source 
The handler of XFixesSetClientDisconnectMode does not check the client
request length.

A client could send a shorter request and read data from a former
request.

Fix the issue by checking the request size matches.

CVE-2025-49177

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Fixes: e167299f6 - xfixes: Add ClientDisconnectMode
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit ab02fb96b1)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2026>
This commit is contained in:
Olivier Fourdan 2025-04-28 10:05:36 +02:00
parent 437a0cad0b
commit b7c5685a26
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
xfixes/disconnect.c
View file

@ -69,6 +69,7 @@ ProcXFixesSetClientDisconnectMode(ClientPtr client)
ClientDisconnectPtr pDisconnect = GetClientDisconnect(client);
REQUEST(xXFixesSetClientDisconnectModeReq);
REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq);
pDisconnect->disconnect_mode = stuff->disconnect_mode;
@ -82,7 +83,7 @@ SProcXFixesSetClientDisconnectMode(ClientPtr client)
swaps(&stuff->length);
REQUEST_AT_LEAST_SIZE(xXFixesSetClientDisconnectModeReq);
REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq);
swapl(&stuff->disconnect_mode);