From 2714e4478c1262c94de6295cce605c14572968d3 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@herrb.eu>
Date: Fri, 19 Feb 2021 15:30:39 +0100
Subject: [PATCH libX11] Reject string longer than USHRT_MAX before sending
them on the wire
The X protocol uses CARD16 values to represent the length so
this would overflow.
CVE-2021-31535
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
[mustard: backported 10 1.6.8 by merging the warning fixes from
upstream commimt 84427130 first - ajax]
---
src/Font.c | 10 ++++++----
src/FontInfo.c | 5 ++++-
src/FontNames.c | 5 ++++-
src/GetColor.c | 6 +++++-
src/LoadFont.c | 6 +++++-
src/LookupCol.c | 6 ++++--
src/ParseCol.c | 7 +++++--
src/QuExt.c | 7 ++++++-
src/SetFPath.c | 12 +++++++++---
src/SetHints.c | 9 ++++++++-
src/StNColor.c | 5 ++++-
src/StName.c | 11 ++++++++---
12 files changed, 68 insertions(+), 21 deletions(-)
diff --git a/src/Font.c b/src/Font.c
index 09d2ae91..1cd89cca 100644
--- a/src/Font.c
+++ b/src/Font.c
@@ -102,12 +102,14 @@ XFontStruct *XLoadQueryFont(
XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
#endif
+ if (strlen(name) >= USHRT_MAX)
+ return NULL;
if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
return font_result;
LockDisplay(dpy);
GetReq(OpenFont, req);
seq = dpy->request; /* Can't use extended sequence number here */
- nbytes = req->nbytes = name ? strlen(name) : 0;
+ nbytes = req->nbytes = (CARD16) (name ? strlen(name) : 0);
req->fid = fid = XAllocID(dpy);
req->length += (nbytes+3)>>2;
Data (dpy, name, nbytes);
@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont(
if (!name)
return 0;
- l = strlen(name);
- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
+ l = (int) strlen(name);
+ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
return 0;
charset = NULL;
/* next three lines stolen from _XkbGetCharset() */
@@ -679,7 +681,7 @@ int _XF86LoadQueryLocaleFont(
return 0;
if (_XlcNCompareISOLatin1(name + l - 2 - (p - charset), charset, p - charset))
return 0;
- if (strlen(p + 1) + l - 1 >= sizeof(buf) - 1)
+ if (strlen(p + 1) + (size_t) l - 1 >= sizeof(buf) - 1)
return 0;
strcpy(buf, name);
strcpy(buf + l - 1, p + 1);
diff --git a/src/FontInfo.c b/src/FontInfo.c
index f870e431..6644b3fa 100644
--- a/src/FontInfo.c
+++ b/src/FontInfo.c
@@ -58,10 +58,13 @@ XFontStruct **info) /* RETURN */
register xListFontsReq *req;
int j;
+ if (strlen(pattern) >= USHRT_MAX)
+ return NULL;
+
LockDisplay(dpy);
GetReq(ListFontsWithInfo, req);
req->maxNames = maxNames;
- nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
+ nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;
req->length += (nbytes + 3) >> 2;
_XSend (dpy, pattern, nbytes);
/* use _XSend instead of Data, since subsequent _XReply will flush buffer */
diff --git a/src/FontNames.c b/src/FontNames.c
index b78792d6..458d80c9 100644
--- a/src/FontNames.c
+++ b/src/FontNames.c
@@ -51,10 +51,13 @@ int *actualCount) /* RETURN */
register xListFontsReq *req;
unsigned long rlen = 0;
+ if (strlen(pattern) >= USHRT_MAX)
+ return NULL;
+
LockDisplay(dpy);
GetReq(ListFonts, req);
req->maxNames = maxNames;
- nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
+ nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;
req->length += (nbytes + 3) >> 2;
_XSend (dpy, pattern, nbytes);
/* use _XSend instead of Data, since following _XReply will flush buffer */
diff --git a/src/GetColor.c b/src/GetColor.c
index cd0eb9f6..c8178067 100644
--- a/src/GetColor.c
+++ b/src/GetColor.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
XcmsColor cmsColor_exact;
Status ret;
+ if (strlen(colorname) >= USHRT_MAX)
+ return (0);
+
#ifdef XCMS
/*
* Let's Attempt to use Xcms and i18n approach to Parse Color
@@ -83,7 +87,7 @@ XColor *exact_def) /* RETURN */
GetReq(AllocNamedColor, req);
req->cmap = cmap;
- nbytes = req->nbytes = strlen(colorname);
+ nbytes = req->nbytes = (CARD16) strlen(colorname);
req->length += (nbytes + 3) >> 2; /* round up to mult of 4 */
_XSend(dpy, colorname, nbytes);
diff --git a/src/LoadFont.c b/src/LoadFont.c
index f547976b..3996436f 100644
--- a/src/LoadFont.c
+++ b/src/LoadFont.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include "Xlibint.h"
Font
@@ -38,12 +39,15 @@ XLoadFont (
Font fid;
register xOpenFontReq *req;
+ if (strlen(name) >= USHRT_MAX)
+ return (0);
+
if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
return fid;
LockDisplay(dpy);
GetReq(OpenFont, req);
- nbytes = req->nbytes = name ? strlen(name) : 0;
+ nbytes = req->nbytes = name ? (CARD16) strlen(name) : 0;
req->fid = fid = XAllocID(dpy);
req->length += (nbytes+3)>>2;
Data (dpy, name, nbytes);
diff --git a/src/LookupCol.c b/src/LookupCol.c
index f7f969f5..cd9b1368 100644
--- a/src/LookupCol.c
+++ b/src/LookupCol.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -46,6 +47,9 @@ XLookupColor (
XcmsCCC ccc;
XcmsColor cmsColor_exact;
+ n = (int) strlen (spec);
+ if (n >= USHRT_MAX)
+ return 0;
#ifdef XCMS
/*
* Let's Attempt to use Xcms and i18n approach to Parse Color
@@ -77,8 +81,6 @@ XLookupColor (
* Xcms and i18n methods failed, so lets pass it to the server
* for parsing.
*/
-
- n = strlen (spec);
LockDisplay(dpy);
GetReq (LookupColor, req);
req->cmap = cmap;
diff --git a/src/ParseCol.c b/src/ParseCol.c
index e997b1b8..7a84a17b 100644
--- a/src/ParseCol.c
+++ b/src/ParseCol.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -46,7 +47,9 @@ XParseColor (
XcmsColor cmsColor;
if (!spec) return(0);
- n = strlen (spec);
+ n = (int) strlen (spec);
+ if (n >= USHRT_MAX)
+ return(0);
if (*spec == '#') {
/*
* RGB
@@ -119,7 +122,7 @@ XParseColor (
LockDisplay(dpy);
GetReq (LookupColor, req);
req->cmap = cmap;
- req->nbytes = n = strlen(spec);
+ req->nbytes = (CARD16) (n = (int) strlen(spec));
req->length += (n + 3) >> 2;
Data (dpy, spec, (long)n);
if (!_XReply (dpy, (xReply *) &reply, 0, xTrue)) {
diff --git a/src/QuExt.c b/src/QuExt.c
index 4e230e77..4cb99fcf 100644
--- a/src/QuExt.c
+++ b/src/QuExt.c
@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
+#include <stdbool.h>
#include "Xlibint.h"
Bool
@@ -40,9 +42,12 @@ XQueryExtension(
xQueryExtensionReply rep;
register xQueryExtensionReq *req;
+ if (strlen(name) >= USHRT_MAX)
+ return false;
+
LockDisplay(dpy);
GetReq(QueryExtension, req);
- req->nbytes = name ? strlen(name) : 0;
+ req->nbytes = name ? (CARD16) strlen(name) : 0;
req->length += (req->nbytes+(unsigned)3)>>2;
_XSend(dpy, name, (long)req->nbytes);
(void) _XReply (dpy, (xReply *)&rep, 0, xTrue);
diff --git a/src/SetFPath.c b/src/SetFPath.c
index 60aaef01..13fce49e 100644
--- a/src/SetFPath.c
+++ b/src/SetFPath.c
@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
+#include <limits.h>
#endif
#include "Xlibint.h"
@@ -48,7 +49,12 @@ XSetFontPath (
GetReq (SetFontPath, req);
req->nFonts = ndirs;
for (i = 0; i < ndirs; i++) {
- n += safestrlen (directories[i]) + 1;
+ n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
+ if (n >= USHRT_MAX) {
+ UnlockDisplay(dpy);
+ SyncHandle();
+ return 0;
+ }
}
nbytes = (n + 3) & ~3;
req->length += nbytes >> 2;
@@ -59,9 +65,9 @@ XSetFontPath (
char *tmp = p;
for (i = 0; i < ndirs; i++) {
- register int length = safestrlen (directories[i]);
+ register int length = (int) safestrlen (directories[i]);
*p = length;
- memcpy (p + 1, directories[i], length);
+ memcpy (p + 1, directories[i], (size_t)length);
p += length + 1;
}
Data (dpy, tmp, nbytes);
diff --git a/src/SetHints.c b/src/SetHints.c
index bc46498a..61cb0684 100644
--- a/src/SetHints.c
+++ b/src/SetHints.c
@@ -49,6 +49,7 @@ SOFTWARE.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <X11/Xlibint.h>
#include <X11/Xutil.h>
#include "Xatomtype.h"
@@ -214,6 +215,8 @@ XSetCommand (
register char *buf, *bp;
for (i = 0, nbytes = 0; i < argc; i++) {
nbytes += safestrlen(argv[i]) + 1;
+ if (nbytes >= USHRT_MAX)
+ return 1;
}
if ((bp = buf = Xmalloc(nbytes))) {
/* copy arguments into single buffer */
@@ -256,11 +259,13 @@ XSetStandardProperties (
if (name != NULL) XStoreName (dpy, w, name);
+ if (safestrlen(icon_string) >= USHRT_MAX)
+ return 1;
if (icon_string != NULL) {
XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
PropModeReplace,
(_Xconst unsigned char *)icon_string,
- safestrlen(icon_string));
+ (int)safestrlen(icon_string));
}
if (icon_pixmap != None) {
@@ -298,6 +303,8 @@ XSetClassHint(
len_nm = safestrlen(classhint->res_name);
len_cl = safestrlen(classhint->res_class);
+ if (len_nm + len_cl >= USHRT_MAX)
+ return 1;
if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
if (len_nm) {
strcpy(s, classhint->res_name);
diff --git a/src/StNColor.c b/src/StNColor.c
index 8b821c3e..16dc9cbc 100644
--- a/src/StNColor.c
+++ b/src/StNColor.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
XcmsColor cmsColor_exact;
XColor scr_def;
+ if (strlen(name) >= USHRT_MAX)
+ return 0;
#ifdef XCMS
/*
* Let's Attempt to use Xcms approach to Parse Color
@@ -76,7 +79,7 @@ int flags) /* DoRed, DoGreen, DoBlue */
req->cmap = cmap;
req->flags = flags;
req->pixel = pixel;
- req->nbytes = nbytes = strlen(name);
+ req->nbytes = (CARD16) (nbytes = (unsigned) strlen(name));
req->length += (nbytes + 3) >> 2; /* round up to multiple of 4 */
Data(dpy, name, (long)nbytes);
UnlockDisplay(dpy);
diff --git a/src/StName.c b/src/StName.c
index b4048bff..04bb3aa6 100644
--- a/src/StName.c
+++ b/src/StName.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <X11/Xlibint.h>
#include <X11/Xatom.h>
@@ -36,9 +37,11 @@ XStoreName (
Window w,
_Xconst char *name)
{
- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
+ if (strlen(name) >= USHRT_MAX)
+ return 0;
+ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
8, PropModeReplace, (_Xconst unsigned char *)name,
- name ? strlen(name) : 0);
+ name ? (int) strlen(name) : 0);
}
int
@@ -47,7 +50,9 @@ XSetIconName (
Window w,
_Xconst char *icon_name)
{
+ if (strlen(icon_name) >= USHRT_MAX)
+ return 0;
return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
PropModeReplace, (_Xconst unsigned char *)icon_name,
- icon_name ? strlen(icon_name) : 0);
+ icon_name ? (int) strlen(icon_name) : 0);
}
--
2.30.1