mirror of
https://gitlab.freedesktop.org/xorg/xserver.git
synced 2026-02-15 02:10:35 +01:00
cd2f91dbc0
This could potentially be security related or crash the server:
XFixesSelectSelectionInput() calls the XACE_SELECTION_ACCESS hook with
wrong parameter type: XID instead of pointer to Selection struct.
It seems that it hadn't been kept up in XACE changed to polyinstantiation.
When XACE is used (eg. Security or SELinux extension enabled), this can
easily lead to memory corruptions at attacker-controlled locations, since
the client-given XID is interpreted as the memory location of Selection
structure.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1556>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| cursor.c | ||
| disconnect.c | ||
| meson.build | ||
| region.c | ||
| saveset.c | ||
| select.c | ||
| xfixes.c | ||
| xfixes.h | ||
| xfixesint.h | ||