From ea526ccb20d222196494b2adf9da52dab68a8997 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Wed, 27 Nov 2024 14:41:45 +0100 Subject: [PATCH] xkb: Fix buffer overflow in XkbVModMaskText() The code in XkbVModMaskText() allocates a fixed sized buffer on the stack and copies the virtual mod name. There's actually two issues in the code that can lead to a buffer overflow. First, the bound check mixes pointers and integers using misplaced parenthesis, defeating the bound check. But even though, if the check fails, the data is still copied, so the stack overflow will occur regardless. Change the logic to skip the copy entirely if the bound check fails. CVE-2025-26595, ZDI-CAN-25545 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative Signed-off-by: Olivier Fourdan Reviewed-by: Peter Hutterer (cherry picked from commit 11fcda8753e994e15eb915d28cf487660ec8e722) Part-of: --- xkb/xkbtext.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c index 00a26c576..b274f2473 100644 --- a/xkb/xkbtext.c +++ b/xkb/xkbtext.c @@ -175,14 +175,14 @@ XkbVModMaskText(XkbDescPtr xkb, len = strlen(tmp) + 1 + (str == buf ? 0 : 1); if (format == XkbCFile) len += 4; - if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) { - if (str != buf) { - if (format == XkbCFile) - *str++ = '|'; - else - *str++ = '+'; - len--; - } + if ((str - buf) + len > VMOD_BUFFER_SIZE) + continue; /* Skip */ + if (str != buf) { + if (format == XkbCFile) + *str++ = '|'; + else + *str++ = '+'; + len--; } if (format == XkbCFile) sprintf(str, "%sMask", tmp);