mirror of
https://gitlab.freedesktop.org/xorg/xserver.git
synced 2026-02-15 13:50:33 +01:00
5279ee435c
When reading requests from the clients, the input buffer might be shared
and used between different clients.
If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.
To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.
CVE-2025-49178
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| .gitignore | ||
| access.c | ||
| auth.c | ||
| backtrace.c | ||
| busfault.c | ||
| busfault.h | ||
| client.c | ||
| connection.c | ||
| inputthread.c | ||
| io.c | ||
| log.c | ||
| meson.build | ||
| mitauth.c | ||
| oscolor.c | ||
| osdep.h | ||
| osinit.c | ||
| ospoll.c | ||
| ospoll.h | ||
| reallocarray.c | ||
| strcasecmp.c | ||
| strcasestr.c | ||
| strlcat.c | ||
| strlcpy.c | ||
| strndup.c | ||
| timingsafe_memcmp.c | ||
| utils.c | ||
| WaitFor.c | ||
| xdmauth.c | ||
| xdmcp.c | ||
| xprintf.c | ||
| xserver_poll.c | ||
| xserver_poll.h | ||
| xsha1.c | ||
| xsha1.h | ||
| xstrans.c | ||