fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-01-09 12:20:19 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Xi: ProcXIGetSelectedEvents needs to use unswapped length to send reply

Browse source 
CVE-2024-31080

Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 96798fc196)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1464>
This commit is contained in:
Alan Coopersmith 2024-03-22 18:51:45 -07:00
parent 4c8de123f0
commit bd16cc8368
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Xi/xiselectev.c
View file

@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
InputClientsPtr others = NULL;
xXIEventMask *evmask = NULL;
DeviceIntPtr dev;
uint32_t length;
REQUEST(xXIGetSelectedEventsReq);
REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client)
}
}
/* save the value before SRepXIGetSelectedEvents swaps it */
length = reply.length;
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
if (reply.num_masks)
WriteToClient(client, reply.length * 4, buffer);
WriteToClient(client, length * 4, buffer);
free(buffer);
return Success;