mirror of
https://gitlab.freedesktop.org/xorg/xserver.git
synced 2025-12-25 18:50:05 +01:00
0885e0b262
Animated cursors use a series of cursors that the client can set. By default, the Xserver assumes at least one cursor is specified while a client may actually pass no cursor at all. That causes an out-of-bound read creating the animated cursor and a crash of the Xserver: | Invalid read of size 8 | at 0x5323F4: AnimCursorCreate (animcur.c:325) | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) | by 0x52DC80: ProcRenderDispatch (render.c:1999) | by 0x4A1E9D: Dispatch (dispatch.c:560) | by 0x4B0169: dix_main (main.c:284) | by 0x4287F5: main (stubmain.c:34) | Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd | at 0x48468D3: reallocarray (vg_replace_malloc.c:1803) | by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802) | by 0x52DC80: ProcRenderDispatch (render.c:1999) | by 0x4A1E9D: Dispatch (dispatch.c:560) | by 0x4B0169: dix_main (main.c:284) | by 0x4287F5: main (stubmain.c:34) | | Invalid read of size 2 | at 0x5323F7: AnimCursorCreate (animcur.c:325) | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) | by 0x52DC80: ProcRenderDispatch (render.c:1999) | by 0x4A1E9D: Dispatch (dispatch.c:560) | by 0x4B0169: dix_main (main.c:284) | by 0x4287F5: main (stubmain.c:34) | Address 0x8 is not stack'd, malloc'd or (recently) free'd To avoid the issue, check the number of cursors specified and return a BadValue error in both the proc handler (early) and the animated cursor creation (as this is a public function) if there is 0 or less cursor. CVE-2025-49175 This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and reported by Julian Suleder via ERNW Vulnerability Disclosure. Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Reviewed-by: José Expósito <jexposit@redhat.com> Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024> |
||
|---|---|---|
| .. | ||
| animcur.c | ||
| filter.c | ||
| glyph.c | ||
| glyphstr.h | ||
| glyphstr_priv.h | ||
| matrix.c | ||
| meson.build | ||
| miindex.c | ||
| mipict.c | ||
| mipict.h | ||
| mirect.c | ||
| mitrap.c | ||
| mitri.c | ||
| picture.c | ||
| picture.h | ||
| picturestr.h | ||
| picturestr_priv.h | ||
| render.c | ||