Find a file
Peter Hutterer 81d70e1125 xkb: swap XkbSetDeviceInfo and XkbSetDeviceInfoCheck
XKB often uses a FooCheck and Foo function pair, the former is supposed
to check all values in the request and error out on BadLength,
BadValue, etc. The latter is then called once we're confident the values
are good (they may still fail on an individual device, but that's a
different topic).

In the case of XkbSetDeviceInfo, those functions were incorrectly
named, with XkbSetDeviceInfo ending up as the checker function and
XkbSetDeviceInfoCheck as the setter function. As a result, the setter
function was called before the checker function, accessing request
data and modifying device state before we ensured that the data is
valid.

In particular, the setter function relied on values being already
byte-swapped. This in turn could lead to potential OOB memory access.

Fix this by correctly naming the functions and moving the length checks
over to the checker function. These were added in 87c64fc5b0 to the
wrong function, probably due to the incorrect naming.

Fixes ZDI-CAN 16070, CVE-2022-2320.

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Introduced in c06e27b2f6

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit dd8caf39e9)
2022-07-12 15:25:24 +02:00
.gitlab-ci Drop Xwin DDX and x86 MinGW-w64 cross build 2022-01-18 12:09:52 +01:00
composite Drop Xorg DDX 2022-01-18 12:09:52 +01:00
damageext Remove autotools support 2021-10-27 13:15:40 +03:00
dbe Drop Xorg DDX 2022-01-18 12:09:52 +01:00
dix Drop config directory 2022-01-18 12:09:52 +01:00
doc Remove autotools support 2021-10-27 13:15:40 +03:00
dri3 Drop Xorg DDX 2022-01-18 12:09:52 +01:00
fb Drop Xorg DDX 2022-01-18 12:09:52 +01:00
glamor Drop Xorg DDX 2022-01-18 12:09:52 +01:00
glx Drop Xorg DDX 2022-01-18 12:09:52 +01:00
hw xwayland: Change randr_output status when call xwl_output_remove() 2022-07-01 10:02:16 +02:00
include Drop config directory 2022-01-18 12:09:52 +01:00
m4 Add ax_pthread.m4 to m4/ 2016-05-29 19:20:51 -07:00
man Remove autotools support 2021-10-27 13:15:40 +03:00
mi Drop Xorg DDX 2022-01-18 12:09:52 +01:00
miext Drop miext/shadow directory 2022-01-18 12:09:52 +01:00
os os: print registers in the libunwind version of xorg_backtrace() 2022-07-01 10:02:16 +02:00
present Drop Xorg DDX 2022-01-18 12:09:52 +01:00
randr randr: Add "RANDR Emulation" property 2022-05-25 09:43:17 +02:00
record record: Fix out of bounds access in SwapCreateRegister() 2021-12-14 15:00:00 +02:00
render render: Fix build with gcc 12 2022-01-28 10:32:04 +01:00
test Drop Xephyr / kdrive DDX 2022-01-18 12:09:52 +01:00
Xext Drop Xorg DDX 2022-01-18 12:09:52 +01:00
xfixes xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier() 2021-12-14 15:00:01 +02:00
Xi Convert more funcs to use InternalEvent. 2021-12-19 20:01:04 +00:00
xkb xkb: swap XkbSetDeviceInfo and XkbSetDeviceInfoCheck 2022-07-12 15:25:24 +02:00
.appveyor.yml Drop Xephyr / kdrive DDX 2022-01-18 12:09:52 +01:00
.dir-locals.el .dir-locals.el: Add missing final newline 2019-10-01 17:05:28 +00:00
.gitignore .gitignore: Add new autotools file 'test-driver' 2014-04-21 13:41:42 -07:00
.gitlab-ci.yml Don't install Xvfb 2022-01-18 12:09:52 +01:00
COPYING modesetting: Merge modesetting's COPYING into the xserver's. 2014-09-15 12:46:02 -07:00
meson.build Bump version to 22.1.2 2022-05-25 10:38:55 +02:00
meson_options.txt meson: Build Xwayland unconditionally 2022-01-18 12:09:52 +01:00
README.md Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
xserver.ent.in doc: relocate xserver.ent in the package root directory 2011-05-14 11:22:26 -07:00

X Server

The X server accepts requests from client applications to create windows, which are (normally rectangular) "virtual screens" that the client program can draw into.

Windows are then composed on the actual screen by the X server (or by a separate composite manager) as directed by the window manager, which usually communicates with the user via graphical controls such as buttons and draggable titlebars and borders.

For a comprehensive overview of X Server and X Window System, consult the following article: https://en.wikipedia.org/wiki/X_server

All questions regarding this software should be directed at the Xorg mailing list:

https://lists.freedesktop.org/mailman/listinfo/xorg

The primary development code repository can be found at:

https://gitlab.freedesktop.org/xorg/xserver

For patch submission instructions, see:

https://www.x.org/wiki/Development/Documentation/SubmittingPatches

As with other projects hosted on freedesktop.org, X.Org follows its Code of Conduct, based on the Contributor Covenant. Please conduct yourself in a respectful and civilized manner when using the above mailing lists, bug trackers, etc:

https://www.freedesktop.org/wiki/CodeOfConduct