mirror of
https://gitlab.freedesktop.org/xorg/xserver.git
synced 2026-06-06 22:18:24 +02:00
a569eb4f36
XLFDMAXFONTNAMELEN was 256 bytes, but libXfont2 defines MAXFONTNAMELEN
as 1024 and allows font names and alias targets up to that length in
fonts.alias files.
doListFontsAndAliases copies the resolved alias target into a
stack-allocated tmp_pattern[XLFDMAXFONTNAMELEN] and then into
c->current.pattern[XLFDMAXFONTNAMELEN] (defined in LFWIstateRec).
doListFontsWithInfo has the same pattern, copying the resolved name into
c->current.pattern[]. With the old 256-byte limit, a fonts.alias entry
with a target name between 257 and 1023 bytes would overflow both
buffers.
An attacker can exploit this by:
1. Creating a font directory with a fonts.alias containing an alias
whose target name exceeds 256 bytes
2. Using SetFontPath to add the malicious directory
3. Calling ListFonts with the alias name to trigger alias resolution
4. The oversized resolved name overflows the 256-byte stack buffer
Increase XLFDMAXFONTNAMELEN from 256 to 1024 to match libXfont2's
MAXFONTNAMELEN, ensuring the server can handle any name the font library
produces.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30136
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit bb5158f962)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
131 lines
3.2 KiB
C
131 lines
3.2 KiB
C
/*
|
|
|
|
Copyright 1991, 1998 The Open Group
|
|
|
|
Permission to use, copy, modify, distribute, and sell this software and its
|
|
documentation for any purpose is hereby granted without fee, provided that
|
|
the above copyright notice appear in all copies and that both that
|
|
copyright notice and this permission notice appear in supporting
|
|
documentation.
|
|
|
|
The above copyright notice and this permission notice shall be included
|
|
in all copies or substantial portions of the Software.
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
|
IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR
|
|
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
|
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
|
OTHER DEALINGS IN THE SOFTWARE.
|
|
|
|
Except as contained in this notice, the name of The Open Group shall
|
|
not be used in advertising or otherwise to promote the sale, use or
|
|
other dealings in this Software without prior written authorization
|
|
from The Open Group.
|
|
|
|
*/
|
|
|
|
#ifndef CLOSESTR_H
|
|
#define CLOSESTR_H
|
|
|
|
#include <X11/Xproto.h>
|
|
#include "closure.h"
|
|
#include "dix.h"
|
|
#include "misc.h"
|
|
#include "gcstruct.h"
|
|
|
|
/* closure structures */
|
|
|
|
/* OpenFont */
|
|
|
|
typedef struct _OFclosure {
|
|
ClientPtr client;
|
|
short current_fpe;
|
|
short num_fpes;
|
|
FontPathElementPtr *fpe_list;
|
|
Mask flags;
|
|
|
|
/* XXX -- get these from request buffer instead? */
|
|
const char *origFontName;
|
|
int origFontNameLen;
|
|
XID fontid;
|
|
char *fontname;
|
|
int fnamelen;
|
|
FontPtr non_cachable_font;
|
|
} OFclosureRec;
|
|
|
|
/* ListFontsWithInfo */
|
|
|
|
/* libXfont2 allows font names/aliases up to MAXFONTNAMELEN (1024) bytes in
|
|
* fonts.alias files. The server's pattern buffers must be large enough to
|
|
* hold resolved alias targets returned by the font library.
|
|
* ZDI-CAN-30136
|
|
*/
|
|
#define XLFDMAXFONTNAMELEN 1024
|
|
typedef struct _LFWIstate {
|
|
char pattern[XLFDMAXFONTNAMELEN];
|
|
int patlen;
|
|
int current_fpe;
|
|
int max_names;
|
|
Bool list_started;
|
|
void *private;
|
|
} LFWIstateRec, *LFWIstatePtr;
|
|
|
|
typedef struct _LFWIclosure {
|
|
ClientPtr client;
|
|
int num_fpes;
|
|
FontPathElementPtr *fpe_list;
|
|
xListFontsWithInfoReply *reply;
|
|
int length;
|
|
LFWIstateRec current;
|
|
LFWIstateRec saved;
|
|
int savedNumFonts;
|
|
Bool haveSaved;
|
|
char *savedName;
|
|
} LFWIclosureRec;
|
|
|
|
/* ListFonts */
|
|
|
|
typedef struct _LFclosure {
|
|
ClientPtr client;
|
|
int num_fpes;
|
|
FontPathElementPtr *fpe_list;
|
|
FontNamesPtr names;
|
|
LFWIstateRec current;
|
|
LFWIstateRec saved;
|
|
Bool haveSaved;
|
|
char *savedName;
|
|
int savedNameLen;
|
|
} LFclosureRec;
|
|
|
|
/* PolyText */
|
|
|
|
typedef struct _PTclosure {
|
|
ClientPtr client;
|
|
DrawablePtr pDraw;
|
|
GC *pGC;
|
|
unsigned char *pElt;
|
|
unsigned char *endReq;
|
|
unsigned char *data;
|
|
int xorg;
|
|
int yorg;
|
|
CARD8 reqType;
|
|
XID did;
|
|
int err;
|
|
} PTclosureRec;
|
|
|
|
/* ImageText */
|
|
|
|
typedef struct _ITclosure {
|
|
ClientPtr client;
|
|
DrawablePtr pDraw;
|
|
GC *pGC;
|
|
BYTE nChars;
|
|
unsigned char *data;
|
|
int xorg;
|
|
int yorg;
|
|
CARD8 reqType;
|
|
XID did;
|
|
} ITclosureRec;
|
|
#endif /* CLOSESTR_H */
|