mirror of
https://gitlab.freedesktop.org/xorg/xserver.git
synced 2026-06-08 06:58:21 +02:00
a439a7340a
CheckKeyActions() validates the per-key action count bytes individually but does not verify that the computed total action data region falls within the request buffer before advancing the wire pointer past it. After the loop, the function calculates the final wire position as wire + nActs * sizeof(XkbAnyAction), where nActs is the sum of per-key action counts read from the request. The upstream length validation in _XkbSetMapCheckLength() uses req->totalActs from the request header, not the computed nActs. If a crafted request provides a totalActs value that passes the length check but per-key action counts that sum to a different nActs, the wire pointer could advance past the actual request buffer. The subsequent SetKeyActions() function uses memcpy to read from this potentially out-of-bounds region, which could leak heap data or cause a crash. Assisted-by: Claude:claude-claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2208> |
||
|---|---|---|
| .. | ||
| ddxBeep.c | ||
| ddxCtrls.c | ||
| ddxKillSrv.c | ||
| ddxLEDs.c | ||
| ddxLoad.c | ||
| ddxPrivate.c | ||
| ddxVT.c | ||
| maprules.c | ||
| meson.build | ||
| README.compiled | ||
| xkb-procs.h | ||
| xkb.c | ||
| xkbAccessX.c | ||
| xkbActions.c | ||
| XKBAlloc.c | ||
| xkbDflts.h | ||
| xkbEvents.c | ||
| xkbfmisc.c | ||
| XKBGAlloc.c | ||
| xkbgeom.h | ||
| xkbInit.c | ||
| xkbLEDs.c | ||
| XKBMAlloc.c | ||
| XKBMisc.c | ||
| xkbout.c | ||
| xkbPrKeyEv.c | ||
| xkbSwap.c | ||
| xkbtext.c | ||
| xkbUtils.c | ||
| XKM_file_format.txt | ||
| xkmread.c | ||
The X server uses this directory to store the compiled version of the
current keymap and/or any scratch keymaps used by clients. The X server
or some other tool might destroy or replace the files in this directory,
so it is not a safe place to store compiled keymaps for long periods of
time. The default keymap for any server is usually stored in:
X<num>-default.xkm
where <num> is the display number of the server in question, which makes
it possible for several servers *on the same host* to share the same
directory.
Unless the X server is modified, sharing this directory between servers on
different hosts could cause problems.