From cdf15ab8f94d54bce72f37653fc46daf482b1671 Mon Sep 17 00:00:00 2001 From: Michal Srb Date: Wed, 24 May 2017 15:54:39 +0300 Subject: [PATCH] Xi: Zero target buffer in SProcXSendExtensionEvent. Make sure that the xEvent eventT is initialized with zeros, the same way as in SProcSendEvent. Some event swapping functions do not overwrite all 32 bytes of xEvent structure, for example XSecurityAuthorizationRevoked. Two cooperating clients, one swapped and the other not, can send XSecurityAuthorizationRevoked event to each other to retrieve old stack data from X server. This can be potentialy misused to go around ASLR or stack-protector. Signed-off-by: Michal Srb Reviewed-by: Peter Hutterer Signed-off-by: Peter Hutterer (cherry picked from commit 05442de962d3dc624f79fc1a00eca3ffc5489ced) --- Xi/sendexev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Xi/sendexev.c b/Xi/sendexev.c index 183f88dae..c9b7dde7c 100644 --- a/Xi/sendexev.c +++ b/Xi/sendexev.c @@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client) { CARD32 *p; int i; - xEvent eventT; + xEvent eventT = { .u.u.type = 0 }; xEvent *eventP; EventSwapPtr proc;