xserver/xkb
Peter Hutterer d17cd09380 xkb: Fix out-of-bounds array access in _CheckSetShapes()
The primaryNdx and approxNdx fields in the shape wire description are
attacker-controlled CARD8 values from the client request. They are used
to index into the shape->outlines[] array, but were only checked against
XkbNoShape (0xff) and never validated against the actual number of
outlines (shapeWire->nOutlines).

Assisted-by: Claude:claude-claude-opus-4-6
(cherry picked from commit 86a321ad98)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2225>
2026-05-30 10:45:58 -07:00
..
ddxBeep.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxCtrls.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxKillSrv.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxLEDs.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxLoad.c os: unexport Fopen(), Fclose(), Popen(), Pclose(), System() 2024-03-09 17:18:46 +00:00
ddxPrivate.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
ddxVT.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
maprules.c xkb: drop defining XKBSRV_NEED_FILE_FUNCS 2024-02-19 00:44:15 +00:00
meson.build Add a Meson build system alongside autotools. 2017-04-26 15:25:27 -07:00
README.compiled R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
xkb-procs.h xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
xkb.c xkb: Fix out-of-bounds array access in _CheckSetShapes() 2026-05-30 10:45:58 -07:00
xkbAccessX.c xkb: add hook to allow/deny AccessX key repeat 2016-06-03 09:39:42 +02:00
xkbActions.c xkb: Fix locked/latched indicator desync across multiple keyboards 2026-04-09 08:59:09 +00:00
XKBAlloc.c xkb: ensure XkbAllocNames sets num_rg to 0 on allocation failure 2025-04-08 10:03:35 +02:00
xkbDflts.h Use ARRAY_SIZE all over the tree 2017-10-30 13:45:20 -04:00
xkbEvents.c xkb: Free the XKB resource when freeing XkbInterest 2025-10-28 14:27:03 +01:00
xkbfmisc.c xkb: drop ununsed XkbNameMatchesPattern() 2024-04-09 06:56:20 +00:00
XKBGAlloc.c xkb: fix incorrect size check when growing doodads in a section 2026-05-30 10:45:21 -07:00
xkbgeom.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xkbInit.c xkb: drop duplicate _X_EXPORT from .c source 2024-03-03 22:34:26 +00:00
xkbLEDs.c dix: Force update LEDs after device state update in EnableDevice 2023-02-21 03:43:05 +00:00
XKBMAlloc.c xkb: Check that needed is > 0 in XkbResizeKeyActions 2025-04-08 10:03:40 +02:00
XKBMisc.c xkb: Fix buffer overflow in XkbChangeTypesOfKey() 2025-02-25 19:38:11 +01:00
xkbout.c xkb: drop defining XKBSRV_NEED_FILE_FUNCS 2024-02-19 00:44:15 +00:00
xkbPrKeyEv.c Revert "xwayland: Don't run key behaviors and actions" 2025-10-15 15:11:13 +02:00
xkbSwap.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
xkbtext.c xkb: fix potential buff overflow in XkbVModIndexText for XkbCFile format 2026-05-30 10:45:34 -07:00
xkbUtils.c xkb: Fix key type without level names in XkbCopyKeymap 2026-04-09 08:59:09 +00:00
XKM_file_format.txt Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
xkmread.c xkb: drop never used XkmProbe() 2024-04-09 06:35:05 +00:00

The X server uses this directory to store the compiled version of the
current keymap and/or any scratch keymaps used by clients.  The X server
or some other tool might destroy or replace the files in this directory,
so it is not a safe place to store compiled keymaps for long periods of
time.  The default keymap for any server is usually stored in:
     X<num>-default.xkm
where <num> is the display number of the server in question, which makes
it possible for several servers *on the same host* to share the same 
directory.

Unless the X server is modified, sharing this directory between servers on
different hosts could cause problems.