xserver/xkb
Peter Hutterer 39befa04f9 xkb: Fix out-of-bounds array access in _CheckSetShapes()
The primaryNdx and approxNdx fields in the shape wire description are
attacker-controlled CARD8 values from the client request. They are used
to index into the shape->outlines[] array, but were only checked against
XkbNoShape (0xff) and never validated against the actual number of
outlines (shapeWire->nOutlines).

Assisted-by: Claude:claude-claude-opus-4-6
(cherry picked from commit 86a321ad98)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
2026-05-30 10:35:53 -07:00
..
ddxBeep.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxCtrls.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxKillSrv.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxLEDs.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxLoad.c xkb: don't require a trailing slash for the XKM output dir 2021-04-09 17:37:29 +00:00
ddxPrivate.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
ddxVT.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
Makefile.am XKB: Remove component listing support 2012-11-19 12:12:28 +10:00
maprules.c xkb: fix check for appending '|' character when applying rules 2016-09-07 15:16:13 +10:00
meson.build Add a Meson build system alongside autotools. 2017-04-26 15:25:27 -07:00
README.compiled R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
xkb.c xkb: Fix out-of-bounds array access in _CheckSetShapes() 2026-05-30 10:35:53 -07:00
xkb.h Move extension initialisation prototypes into extinit.h 2012-07-09 23:06:41 -07:00
xkbAccessX.c xkb: add hook to allow/deny AccessX key repeat 2016-06-03 09:39:42 +02:00
xkbActions.c xkb: Fix locked/latched indicator desync across multiple keyboards 2026-03-28 16:40:00 +00:00
XKBAlloc.c xkb: ensure XkbAllocNames sets num_rg to 0 on allocation failure 2025-04-08 09:50:29 +02:00
xkbDflts.h Use ARRAY_SIZE all over the tree 2017-10-30 13:45:20 -04:00
xkbEvents.c xkb: Free the XKB resource when freeing XkbInterest 2025-10-28 14:15:35 +01:00
xkbfmisc.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
XKBGAlloc.c xkb: fix incorrect size check when growing doodads in a section 2026-05-30 10:16:12 -07:00
xkbgeom.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xkbInit.c xkb: Write the _XKB_RULES_NAMES window property synchronously 2018-11-13 10:36:18 -05:00
xkbLEDs.c xkb: after changing the keymap, force an indicator update 2016-05-04 10:55:09 -04:00
XKBMAlloc.c xkb: Check that needed is > 0 in XkbResizeKeyActions 2025-04-08 09:50:36 +02:00
XKBMisc.c xkb: Fix buffer overflow in XkbChangeTypesOfKey() 2025-02-25 19:36:29 +01:00
xkbout.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xkbPrKeyEv.c xkb: Match key releases with an overlaid press 2017-01-04 13:23:31 +10:00
xkbSwap.c Fix XkbSelectEvents() integer underflow 2020-08-25 17:01:29 +02:00
xkbtext.c xkb: fix potential buff overflow in XkbVModIndexText for XkbCFile format 2026-05-30 10:35:53 -07:00
xkbUtils.c xkb: Fix key type without level names in XkbCopyKeymap 2026-03-28 16:40:00 +00:00
XKM_file_format.txt Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
xkmread.c xkb: Fix parsing of XkbSA_DeviceValuator action type 2021-03-30 18:47:04 +00:00

The X server uses this directory to store the compiled version of the
current keymap and/or any scratch keymaps used by clients.  The X server
or some other tool might destroy or replace the files in this directory,
so it is not a safe place to store compiled keymaps for long periods of
time.  The default keymap for any server is usually stored in:
     X<num>-default.xkm
where <num> is the display number of the server in question, which makes
it possible for several servers *on the same host* to share the same 
directory.

Unless the X server is modified, sharing this directory between servers on
different hosts could cause problems.