From 2714e4478c1262c94de6295cce605c14572968d3 Mon Sep 17 00:00:00 2001

From: Matthieu Herrb <matthieu@herrb.eu>

Date: Fri, 19 Feb 2021 15:30:39 +0100

Subject: [PATCH libX11] Reject string longer than USHRT_MAX before sending

 them on the wire

The X protocol uses CARD16 values to represent the length so

this would overflow.

CVE-2021-31535

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>

[mustard: backported 10 1.6.8 by merging the warning fixes from

upstream commimt 84427130 first - ajax]

---

 src/Font.c      | 10 ++++++----

 src/FontInfo.c  |  5 ++++-

 src/FontNames.c |  5 ++++-

 src/GetColor.c  |  6 +++++-

 src/LoadFont.c  |  6 +++++-

 src/LookupCol.c |  6 ++++--

 src/ParseCol.c  |  7 +++++--

 src/QuExt.c     |  7 ++++++-

 src/SetFPath.c  | 12 +++++++++---

 src/SetHints.c  |  9 ++++++++-

 src/StNColor.c  |  5 ++++-

 src/StName.c    | 11 ++++++++---

 12 files changed, 68 insertions(+), 21 deletions(-)

diff --git a/src/Font.c b/src/Font.c

index 09d2ae91..1cd89cca 100644

--- a/src/Font.c

+++ b/src/Font.c

@@ -102,12 +102,14 @@ XFontStruct *XLoadQueryFont(

     XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);

 #endif

+    if (strlen(name) >= USHRT_MAX)

+        return NULL;

     if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))

       return font_result;

     LockDisplay(dpy);

     GetReq(OpenFont, req);

     seq = dpy->request; /* Can't use extended sequence number here */

-    nbytes = req->nbytes  = name ? strlen(name) : 0;

+    nbytes = req->nbytes = (CARD16) (name ? strlen(name) : 0);

     req->fid = fid = XAllocID(dpy);

     req->length += (nbytes+3)>>2;

     Data (dpy, name, nbytes);

@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont(

     if (!name)

 	return 0;

-    l = strlen(name);

-    if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')

+    l = (int) strlen(name);

+    if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)

 	return 0;

     charset = NULL;

     /* next three lines stolen from _XkbGetCharset() */

@@ -679,7 +681,7 @@ int _XF86LoadQueryLocaleFont(

 	return 0;

     if (_XlcNCompareISOLatin1(name + l - 2 - (p - charset), charset, p - charset))

 	return 0;

-    if (strlen(p + 1) + l - 1 >= sizeof(buf) - 1)

+    if (strlen(p + 1) + (size_t) l - 1 >= sizeof(buf) - 1)

 	return 0;

     strcpy(buf, name);

     strcpy(buf + l - 1, p + 1);

diff --git a/src/FontInfo.c b/src/FontInfo.c

index f870e431..6644b3fa 100644

--- a/src/FontInfo.c

+++ b/src/FontInfo.c

@@ -58,10 +58,13 @@ XFontStruct **info)	/* RETURN */

     register xListFontsReq *req;

     int j;

+    if (strlen(pattern) >= USHRT_MAX)

+        return NULL;

+

     LockDisplay(dpy);

     GetReq(ListFontsWithInfo, req);

     req->maxNames = maxNames;

-    nbytes = req->nbytes = pattern ? strlen (pattern) : 0;

+    nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;

     req->length += (nbytes + 3) >> 2;

     _XSend (dpy, pattern, nbytes);

     /* use _XSend instead of Data, since subsequent _XReply will flush buffer */

diff --git a/src/FontNames.c b/src/FontNames.c

index b78792d6..458d80c9 100644

--- a/src/FontNames.c

+++ b/src/FontNames.c

@@ -51,10 +51,13 @@ int *actualCount)	/* RETURN */

     register xListFontsReq *req;

     unsigned long rlen = 0;

+    if (strlen(pattern) >= USHRT_MAX)

+        return NULL;

+

     LockDisplay(dpy);

     GetReq(ListFonts, req);

     req->maxNames = maxNames;

-    nbytes = req->nbytes = pattern ? strlen (pattern) : 0;

+    nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;

     req->length += (nbytes + 3) >> 2;

     _XSend (dpy, pattern, nbytes);

     /* use _XSend instead of Data, since following _XReply will flush buffer */

diff --git a/src/GetColor.c b/src/GetColor.c

index cd0eb9f6..c8178067 100644

--- a/src/GetColor.c

+++ b/src/GetColor.c

@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

 #endif

+#include <limits.h>

 #include <stdio.h>

 #include "Xlibint.h"

 #include "Xcmsint.h"

@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */

     XcmsColor cmsColor_exact;

     Status ret;

+    if (strlen(colorname) >= USHRT_MAX)

+        return (0);

+

 #ifdef XCMS

     /*

      * Let's Attempt to use Xcms and i18n approach to Parse Color

@@ -83,7 +87,7 @@ XColor *exact_def) /* RETURN */

     GetReq(AllocNamedColor, req);

     req->cmap = cmap;

-    nbytes = req->nbytes = strlen(colorname);

+    nbytes = req->nbytes = (CARD16) strlen(colorname);

     req->length += (nbytes + 3) >> 2; /* round up to mult of 4 */

     _XSend(dpy, colorname, nbytes);

diff --git a/src/LoadFont.c b/src/LoadFont.c

index f547976b..3996436f 100644

--- a/src/LoadFont.c

+++ b/src/LoadFont.c

@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

 #endif

+#include <limits.h>

 #include "Xlibint.h"

 Font

@@ -38,12 +39,15 @@ XLoadFont (

     Font fid;

     register xOpenFontReq *req;

+    if (strlen(name) >= USHRT_MAX)

+        return (0);

+

     if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))

       return fid;

     LockDisplay(dpy);

     GetReq(OpenFont, req);

-    nbytes = req->nbytes = name ? strlen(name) : 0;

+    nbytes = req->nbytes = name ? (CARD16) strlen(name) : 0;

     req->fid = fid = XAllocID(dpy);

     req->length += (nbytes+3)>>2;

     Data (dpy, name, nbytes);

diff --git a/src/LookupCol.c b/src/LookupCol.c

index f7f969f5..cd9b1368 100644

--- a/src/LookupCol.c

+++ b/src/LookupCol.c

@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

 #endif

+#include <limits.h>

 #include <stdio.h>

 #include "Xlibint.h"

 #include "Xcmsint.h"

@@ -46,6 +47,9 @@ XLookupColor (

 	XcmsCCC ccc;

 	XcmsColor cmsColor_exact;

+	n = (int) strlen (spec);

+	if (n >= USHRT_MAX)

+            return 0;

 #ifdef XCMS

 	/*

 	 * Let's Attempt to use Xcms and i18n approach to Parse Color

@@ -77,8 +81,6 @@ XLookupColor (

 	 * Xcms and i18n methods failed, so lets pass it to the server

 	 * for parsing.

 	 */

-

-	n = strlen (spec);

 	LockDisplay(dpy);

 	GetReq (LookupColor, req);

 	req->cmap = cmap;

diff --git a/src/ParseCol.c b/src/ParseCol.c

index e997b1b8..7a84a17b 100644

--- a/src/ParseCol.c

+++ b/src/ParseCol.c

@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

 #endif

+#include <limits.h>

 #include <stdio.h>

 #include "Xlibint.h"

 #include "Xcmsint.h"

@@ -46,7 +47,9 @@ XParseColor (

 	XcmsColor cmsColor;

         if (!spec) return(0);

-	n = strlen (spec);

+	n = (int) strlen (spec);

+	if (n >= USHRT_MAX)

+            return(0);

 	if (*spec == '#') {

 	    /*

 	     * RGB

@@ -119,7 +122,7 @@ XParseColor (

 	    LockDisplay(dpy);

 	    GetReq (LookupColor, req);

 	    req->cmap = cmap;

-	    req->nbytes = n = strlen(spec);

+	    req->nbytes = (CARD16) (n = (int) strlen(spec));

 	    req->length += (n + 3) >> 2;

 	    Data (dpy, spec, (long)n);

 	    if (!_XReply (dpy, (xReply *) &reply, 0, xTrue)) {

diff --git a/src/QuExt.c b/src/QuExt.c

index 4e230e77..4cb99fcf 100644

--- a/src/QuExt.c

+++ b/src/QuExt.c

@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

 #endif

+#include <limits.h>

+#include <stdbool.h>

 #include "Xlibint.h"

 Bool

@@ -40,9 +42,12 @@ XQueryExtension(

     xQueryExtensionReply rep;

     register xQueryExtensionReq *req;

+    if (strlen(name) >= USHRT_MAX)

+        return false;

+

     LockDisplay(dpy);

     GetReq(QueryExtension, req);

-    req->nbytes = name ? strlen(name) : 0;

+    req->nbytes = name ? (CARD16) strlen(name) : 0;

     req->length += (req->nbytes+(unsigned)3)>>2;

     _XSend(dpy, name, (long)req->nbytes);

     (void) _XReply (dpy, (xReply *)&rep, 0, xTrue);

diff --git a/src/SetFPath.c b/src/SetFPath.c

index 60aaef01..13fce49e 100644

--- a/src/SetFPath.c

+++ b/src/SetFPath.c

@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

+#include <limits.h>

 #endif

 #include "Xlibint.h"

@@ -48,7 +49,12 @@ XSetFontPath (

 	GetReq (SetFontPath, req);

 	req->nFonts = ndirs;

 	for (i = 0; i < ndirs; i++) {

-		n += safestrlen (directories[i]) + 1;

+		n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));

+		if (n >= USHRT_MAX) {

+			UnlockDisplay(dpy);

+			SyncHandle();

+			return 0;

+		}

 	}

 	nbytes = (n + 3) & ~3;

 	req->length += nbytes >> 2;

@@ -59,9 +65,9 @@ XSetFontPath (

 		char	*tmp = p;

 		for (i = 0; i < ndirs; i++) {

-			register int length = safestrlen (directories[i]);

+			register int length = (int) safestrlen (directories[i]);

 			*p = length;

-			memcpy (p + 1, directories[i], length);

+			memcpy (p + 1, directories[i], (size_t)length);

 			p += length + 1;

 		}

 		Data (dpy, tmp, nbytes);

diff --git a/src/SetHints.c b/src/SetHints.c

index bc46498a..61cb0684 100644

--- a/src/SetHints.c

+++ b/src/SetHints.c

@@ -49,6 +49,7 @@ SOFTWARE.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

 #endif

+#include <limits.h>

 #include <X11/Xlibint.h>

 #include <X11/Xutil.h>

 #include "Xatomtype.h"

@@ -214,6 +215,8 @@ XSetCommand (

 	register char *buf, *bp;

 	for (i = 0, nbytes = 0; i < argc; i++) {

 		nbytes += safestrlen(argv[i]) + 1;

+		if (nbytes >= USHRT_MAX)

+                    return 1;

 	}

 	if ((bp = buf = Xmalloc(nbytes))) {

 	    /* copy arguments into single buffer */

@@ -256,11 +259,13 @@ XSetStandardProperties (

 	if (name != NULL) XStoreName (dpy, w, name);

+        if (safestrlen(icon_string) >= USHRT_MAX)

+            return 1;

 	if (icon_string != NULL) {

 	    XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,

                              PropModeReplace,

                              (_Xconst unsigned char *)icon_string,

-                             safestrlen(icon_string));

+                             (int)safestrlen(icon_string));

 		}

 	if (icon_pixmap != None) {

@@ -298,6 +303,8 @@ XSetClassHint(

 	len_nm = safestrlen(classhint->res_name);

 	len_cl = safestrlen(classhint->res_class);

+        if (len_nm + len_cl >= USHRT_MAX)

+            return 1;

 	if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {

 	    if (len_nm) {

 		strcpy(s, classhint->res_name);

diff --git a/src/StNColor.c b/src/StNColor.c

index 8b821c3e..16dc9cbc 100644

--- a/src/StNColor.c

+++ b/src/StNColor.c

@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

 #endif

+#include <limits.h>

 #include <stdio.h>

 #include "Xlibint.h"

 #include "Xcmsint.h"

@@ -46,6 +47,8 @@ int flags)  /* DoRed, DoGreen, DoBlue */

     XcmsColor cmsColor_exact;

     XColor scr_def;

+    if (strlen(name) >= USHRT_MAX)

+        return 0;

 #ifdef XCMS

     /*

      * Let's Attempt to use Xcms approach to Parse Color

@@ -76,7 +79,7 @@ int flags)  /* DoRed, DoGreen, DoBlue */

     req->cmap = cmap;

     req->flags = flags;

     req->pixel = pixel;

-    req->nbytes = nbytes = strlen(name);

+    req->nbytes = (CARD16) (nbytes = (unsigned) strlen(name));

     req->length += (nbytes + 3) >> 2; /* round up to multiple of 4 */

     Data(dpy, name, (long)nbytes);

     UnlockDisplay(dpy);

diff --git a/src/StName.c b/src/StName.c

index b4048bff..04bb3aa6 100644

--- a/src/StName.c

+++ b/src/StName.c

@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.

 #ifdef HAVE_CONFIG_H

 #include <config.h>

 #endif

+#include <limits.h>

 #include <X11/Xlibint.h>

 #include <X11/Xatom.h>

@@ -36,9 +37,11 @@ XStoreName (

     Window w,

     _Xconst char *name)

 {

-    return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,

+    if (strlen(name) >= USHRT_MAX)

+        return 0;

+    return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /*  */

 			   8, PropModeReplace, (_Xconst unsigned char *)name,

-			   name ? strlen(name) : 0);

+			   name ? (int) strlen(name) : 0);

 }

 int

@@ -47,7 +50,9 @@ XSetIconName (

     Window w,

     _Xconst char *icon_name)

 {

+    if (strlen(icon_name) >= USHRT_MAX)

+        return 0;

     return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,

                            PropModeReplace, (_Xconst unsigned char *)icon_name,

-			   icon_name ? strlen(icon_name) : 0);

+			   icon_name ? (int) strlen(icon_name) : 0);

 }

-- 

2.30.1