xserver/xkb
Peter Hutterer dd8caf39e9 xkb: swap XkbSetDeviceInfo and XkbSetDeviceInfoCheck
XKB often uses a FooCheck and Foo function pair, the former is supposed
to check all values in the request and error out on BadLength,
BadValue, etc. The latter is then called once we're confident the values
are good (they may still fail on an individual device, but that's a
different topic).

In the case of XkbSetDeviceInfo, those functions were incorrectly
named, with XkbSetDeviceInfo ending up as the checker function and
XkbSetDeviceInfoCheck as the setter function. As a result, the setter
function was called before the checker function, accessing request
data and modifying device state before we ensured that the data is
valid.

In particular, the setter function relied on values being already
byte-swapped. This in turn could lead to potential OOB memory access.

Fix this by correctly naming the functions and moving the length checks
over to the checker function. These were added in 87c64fc5b0 to the
wrong function, probably due to the incorrect naming.

Fixes ZDI-CAN 16070, CVE-2022-2320.

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Introduced in c06e27b2f6

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2022-07-12 15:18:52 +03:00
..
ddxBeep.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxCtrls.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxKillSrv.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxLEDs.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxLoad.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
ddxPrivate.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
ddxVT.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
maprules.c xkb: fix check for appending '|' character when applying rules 2016-09-07 15:16:13 +10:00
meson.build Add a Meson build system alongside autotools. 2017-04-26 15:25:27 -07:00
README.compiled R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
xkb-procs.h xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
xkb.c xkb: swap XkbSetDeviceInfo and XkbSetDeviceInfoCheck 2022-07-12 15:18:52 +03:00
xkbAccessX.c xkb: add hook to allow/deny AccessX key repeat 2016-06-03 09:39:42 +02:00
xkbActions.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
XKBAlloc.c Convert XKB to new *allocarray functions 2015-04-21 16:57:54 -07:00
xkbDflts.h Use ARRAY_SIZE all over the tree 2017-10-30 13:45:20 -04:00
xkbEvents.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
xkbfmisc.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
XKBGAlloc.c xkb: Fix heap overflow caused by optimized away min. 2020-12-04 18:31:06 -05:00
xkbgeom.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xkbInit.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
xkbLEDs.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
XKBMAlloc.c xserver: Unifdef HAVE_CONFIG_H 2017-03-23 13:19:51 -04:00
XKBMisc.c xkb: always set *mask_rtrn in XkbVirtualModsToReal 2020-11-17 18:43:39 -08:00
xkbout.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xkbPrKeyEv.c xkb: Match key releases with an overlaid press 2017-01-04 13:23:31 +10:00
xkbSwap.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
xkbtext.c xkbtext: fix copy-paste error 2022-04-02 18:06:30 +00:00
xkbUtils.c xkb: rename xkb.h to xkb-procs.h 2022-07-08 14:27:04 +00:00
XKM_file_format.txt Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
xkmread.c xkb: Fix parsing of XkbSA_DeviceValuator action type 2021-03-30 18:47:04 +00:00

The X server uses this directory to store the compiled version of the
current keymap and/or any scratch keymaps used by clients.  The X server
or some other tool might destroy or replace the files in this directory,
so it is not a safe place to store compiled keymaps for long periods of
time.  The default keymap for any server is usually stored in:
     X<num>-default.xkm
where <num> is the display number of the server in question, which makes
it possible for several servers *on the same host* to share the same 
directory.

Unless the X server is modified, sharing this directory between servers on
different hosts could cause problems.