fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-02-15 08:00:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

xkb: Prevent overflow in XkbSetCompatMap()

Browse source 
The XkbCompatMap structure stores its "num_si" and "size_si" fields
using an unsigned short.

However, the function _XkbSetCompatMap() will store the sum of the
input data "firstSI" and "nSI" in both XkbCompatMap's "num_si" and
"size_si" without first checking if the sum overflows the maximum
unsigned short value, leading to a possible overflow.

To avoid the issue, check whether the sum does not exceed the maximum
unsigned short value, or return a "BadValue" error otherwise.

CVE-2025-62231, ZDI-CAN-27560

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
(cherry picked from commit 475d9f49ac)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2088>
This commit is contained in:
Olivier Fourdan 2025-09-10 16:30:29 +02:00
parent 1abca0b9b5
commit c7beaec76c
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
xkb/xkb.c
View file

@ -2990,6 +2990,8 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
XkbSymInterpretPtr sym;
unsigned int skipped = 0;
if ((unsigned) (req->firstSI + req->nSI) > USHRT_MAX)
return BadValue;
if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
compat->num_si = compat->size_si = req->firstSI + req->nSI;
compat->sym_interpret = reallocarray(compat->sym_interpret,