wok-current view xorg-server/stuff/CVE-2022-3550.patch @ rev 25701
Fix dep for libglamoregl.so (libepoxy), and miss file for amdgpu (thanks alanyih)
| author | Stanislas Leduc <shann@slitaz.org> |
|---|---|
| date | Fri Apr 19 12:48:51 2024 +0000 (7 months ago) |
| parents | |
| children |
line source
1 From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001
2 From: Peter Hutterer <peter.hutterer@who-t.net>
3 Date: Tue, 5 Jul 2022 12:06:20 +1000
4 Subject: xkb: proof GetCountedString against request length attacks
6 GetCountedString did a check for the whole string to be within the
7 request buffer but not for the initial 2 bytes that contain the length
8 field. A swapped client could send a malformed request to trigger a
9 swaps() on those bytes, writing into random memory.
11 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
12 ---
13 xkb/xkb.c | 5 +++++
14 1 file changed, 5 insertions(+)
16 diff --git a/xkb/xkb.c b/xkb/xkb.c
17 index f42f59ef3..1841cff26 100644
18 --- a/xkb/xkb.c
19 +++ b/xkb/xkb.c
20 @@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str)
21 CARD16 len;
23 wire = *wire_inout;
24 +
25 + if (client->req_len <
26 + bytes_to_int32(wire + 2 - (char *) client->requestBuffer))
27 + return BadValue;
28 +
29 len = *(CARD16 *) wire;
30 if (client->swapped) {
31 swaps(&len);
32 --
33 cgit v1.2.1