From 2714e4478c1262c94de6295cce605c14572968d3 Mon Sep 17 00:00:00 2001 From: Matthieu Herrb Date: Fri, 19 Feb 2021 15:30:39 +0100 Subject: [PATCH libX11] Reject string longer than USHRT_MAX before sending them on the wire The X protocol uses CARD16 values to represent the length so this would overflow. CVE-2021-31535 Signed-off-by: Matthieu Herrb [mustard: backported 10 1.6.8 by merging the warning fixes from upstream commimt 84427130 first - ajax] --- src/Font.c | 10 ++++++---- src/FontInfo.c | 5 ++++- src/FontNames.c | 5 ++++- src/GetColor.c | 6 +++++- src/LoadFont.c | 6 +++++- src/LookupCol.c | 6 ++++-- src/ParseCol.c | 7 +++++-- src/QuExt.c | 7 ++++++- src/SetFPath.c | 12 +++++++++--- src/SetHints.c | 9 ++++++++- src/StNColor.c | 5 ++++- src/StName.c | 11 ++++++++--- 12 files changed, 68 insertions(+), 21 deletions(-) diff --git a/src/Font.c b/src/Font.c index 09d2ae91..1cd89cca 100644 --- a/src/Font.c +++ b/src/Font.c @@ -102,12 +102,14 @@ XFontStruct *XLoadQueryFont( XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy); #endif + if (strlen(name) >= USHRT_MAX) + return NULL; if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0)) return font_result; LockDisplay(dpy); GetReq(OpenFont, req); seq = dpy->request; /* Can't use extended sequence number here */ - nbytes = req->nbytes = name ? strlen(name) : 0; + nbytes = req->nbytes = (CARD16) (name ? strlen(name) : 0); req->fid = fid = XAllocID(dpy); req->length += (nbytes+3)>>2; Data (dpy, name, nbytes); @@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont( if (!name) return 0; - l = strlen(name); - if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-') + l = (int) strlen(name); + if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX) return 0; charset = NULL; /* next three lines stolen from _XkbGetCharset() */ @@ -679,7 +681,7 @@ int _XF86LoadQueryLocaleFont( return 0; if (_XlcNCompareISOLatin1(name + l - 2 - (p - charset), charset, p - charset)) return 0; - if (strlen(p + 1) + l - 1 >= sizeof(buf) - 1) + if (strlen(p + 1) + (size_t) l - 1 >= sizeof(buf) - 1) return 0; strcpy(buf, name); strcpy(buf + l - 1, p + 1); diff --git a/src/FontInfo.c b/src/FontInfo.c index f870e431..6644b3fa 100644 --- a/src/FontInfo.c +++ b/src/FontInfo.c @@ -58,10 +58,13 @@ XFontStruct **info) /* RETURN */ register xListFontsReq *req; int j; + if (strlen(pattern) >= USHRT_MAX) + return NULL; + LockDisplay(dpy); GetReq(ListFontsWithInfo, req); req->maxNames = maxNames; - nbytes = req->nbytes = pattern ? strlen (pattern) : 0; + nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0; req->length += (nbytes + 3) >> 2; _XSend (dpy, pattern, nbytes); /* use _XSend instead of Data, since subsequent _XReply will flush buffer */ diff --git a/src/FontNames.c b/src/FontNames.c index b78792d6..458d80c9 100644 --- a/src/FontNames.c +++ b/src/FontNames.c @@ -51,10 +51,13 @@ int *actualCount) /* RETURN */ register xListFontsReq *req; unsigned long rlen = 0; + if (strlen(pattern) >= USHRT_MAX) + return NULL; + LockDisplay(dpy); GetReq(ListFonts, req); req->maxNames = maxNames; - nbytes = req->nbytes = pattern ? strlen (pattern) : 0; + nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0; req->length += (nbytes + 3) >> 2; _XSend (dpy, pattern, nbytes); /* use _XSend instead of Data, since following _XReply will flush buffer */ diff --git a/src/GetColor.c b/src/GetColor.c index cd0eb9f6..c8178067 100644 --- a/src/GetColor.c +++ b/src/GetColor.c @@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. #ifdef HAVE_CONFIG_H #include #endif +#include #include #include "Xlibint.h" #include "Xcmsint.h" @@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */ XcmsColor cmsColor_exact; Status ret; + if (strlen(colorname) >= USHRT_MAX) + return (0); + #ifdef XCMS /* * Let's Attempt to use Xcms and i18n approach to Parse Color @@ -83,7 +87,7 @@ XColor *exact_def) /* RETURN */ GetReq(AllocNamedColor, req); req->cmap = cmap; - nbytes = req->nbytes = strlen(colorname); + nbytes = req->nbytes = (CARD16) strlen(colorname); req->length += (nbytes + 3) >> 2; /* round up to mult of 4 */ _XSend(dpy, colorname, nbytes); diff --git a/src/LoadFont.c b/src/LoadFont.c index f547976b..3996436f 100644 --- a/src/LoadFont.c +++ b/src/LoadFont.c @@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. #ifdef HAVE_CONFIG_H #include #endif +#include #include "Xlibint.h" Font @@ -38,12 +39,15 @@ XLoadFont ( Font fid; register xOpenFontReq *req; + if (strlen(name) >= USHRT_MAX) + return (0); + if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid)) return fid; LockDisplay(dpy); GetReq(OpenFont, req); - nbytes = req->nbytes = name ? strlen(name) : 0; + nbytes = req->nbytes = name ? (CARD16) strlen(name) : 0; req->fid = fid = XAllocID(dpy); req->length += (nbytes+3)>>2; Data (dpy, name, nbytes); diff --git a/src/LookupCol.c b/src/LookupCol.c index f7f969f5..cd9b1368 100644 --- a/src/LookupCol.c +++ b/src/LookupCol.c @@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. #ifdef HAVE_CONFIG_H #include #endif +#include #include #include "Xlibint.h" #include "Xcmsint.h" @@ -46,6 +47,9 @@ XLookupColor ( XcmsCCC ccc; XcmsColor cmsColor_exact; + n = (int) strlen (spec); + if (n >= USHRT_MAX) + return 0; #ifdef XCMS /* * Let's Attempt to use Xcms and i18n approach to Parse Color @@ -77,8 +81,6 @@ XLookupColor ( * Xcms and i18n methods failed, so lets pass it to the server * for parsing. */ - - n = strlen (spec); LockDisplay(dpy); GetReq (LookupColor, req); req->cmap = cmap; diff --git a/src/ParseCol.c b/src/ParseCol.c index e997b1b8..7a84a17b 100644 --- a/src/ParseCol.c +++ b/src/ParseCol.c @@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. #ifdef HAVE_CONFIG_H #include #endif +#include #include #include "Xlibint.h" #include "Xcmsint.h" @@ -46,7 +47,9 @@ XParseColor ( XcmsColor cmsColor; if (!spec) return(0); - n = strlen (spec); + n = (int) strlen (spec); + if (n >= USHRT_MAX) + return(0); if (*spec == '#') { /* * RGB @@ -119,7 +122,7 @@ XParseColor ( LockDisplay(dpy); GetReq (LookupColor, req); req->cmap = cmap; - req->nbytes = n = strlen(spec); + req->nbytes = (CARD16) (n = (int) strlen(spec)); req->length += (n + 3) >> 2; Data (dpy, spec, (long)n); if (!_XReply (dpy, (xReply *) &reply, 0, xTrue)) { diff --git a/src/QuExt.c b/src/QuExt.c index 4e230e77..4cb99fcf 100644 --- a/src/QuExt.c +++ b/src/QuExt.c @@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group. #ifdef HAVE_CONFIG_H #include #endif +#include +#include #include "Xlibint.h" Bool @@ -40,9 +42,12 @@ XQueryExtension( xQueryExtensionReply rep; register xQueryExtensionReq *req; + if (strlen(name) >= USHRT_MAX) + return false; + LockDisplay(dpy); GetReq(QueryExtension, req); - req->nbytes = name ? strlen(name) : 0; + req->nbytes = name ? (CARD16) strlen(name) : 0; req->length += (req->nbytes+(unsigned)3)>>2; _XSend(dpy, name, (long)req->nbytes); (void) _XReply (dpy, (xReply *)&rep, 0, xTrue); diff --git a/src/SetFPath.c b/src/SetFPath.c index 60aaef01..13fce49e 100644 --- a/src/SetFPath.c +++ b/src/SetFPath.c @@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group. #ifdef HAVE_CONFIG_H #include +#include #endif #include "Xlibint.h" @@ -48,7 +49,12 @@ XSetFontPath ( GetReq (SetFontPath, req); req->nFonts = ndirs; for (i = 0; i < ndirs; i++) { - n += safestrlen (directories[i]) + 1; + n = (int) ((size_t) n + (safestrlen (directories[i]) + 1)); + if (n >= USHRT_MAX) { + UnlockDisplay(dpy); + SyncHandle(); + return 0; + } } nbytes = (n + 3) & ~3; req->length += nbytes >> 2; @@ -59,9 +65,9 @@ XSetFontPath ( char *tmp = p; for (i = 0; i < ndirs; i++) { - register int length = safestrlen (directories[i]); + register int length = (int) safestrlen (directories[i]); *p = length; - memcpy (p + 1, directories[i], length); + memcpy (p + 1, directories[i], (size_t)length); p += length + 1; } Data (dpy, tmp, nbytes); diff --git a/src/SetHints.c b/src/SetHints.c index bc46498a..61cb0684 100644 --- a/src/SetHints.c +++ b/src/SetHints.c @@ -49,6 +49,7 @@ SOFTWARE. #ifdef HAVE_CONFIG_H #include #endif +#include #include #include #include "Xatomtype.h" @@ -214,6 +215,8 @@ XSetCommand ( register char *buf, *bp; for (i = 0, nbytes = 0; i < argc; i++) { nbytes += safestrlen(argv[i]) + 1; + if (nbytes >= USHRT_MAX) + return 1; } if ((bp = buf = Xmalloc(nbytes))) { /* copy arguments into single buffer */ @@ -256,11 +259,13 @@ XSetStandardProperties ( if (name != NULL) XStoreName (dpy, w, name); + if (safestrlen(icon_string) >= USHRT_MAX) + return 1; if (icon_string != NULL) { XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8, PropModeReplace, (_Xconst unsigned char *)icon_string, - safestrlen(icon_string)); + (int)safestrlen(icon_string)); } if (icon_pixmap != None) { @@ -298,6 +303,8 @@ XSetClassHint( len_nm = safestrlen(classhint->res_name); len_cl = safestrlen(classhint->res_class); + if (len_nm + len_cl >= USHRT_MAX) + return 1; if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) { if (len_nm) { strcpy(s, classhint->res_name); diff --git a/src/StNColor.c b/src/StNColor.c index 8b821c3e..16dc9cbc 100644 --- a/src/StNColor.c +++ b/src/StNColor.c @@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. #ifdef HAVE_CONFIG_H #include #endif +#include #include #include "Xlibint.h" #include "Xcmsint.h" @@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */ XcmsColor cmsColor_exact; XColor scr_def; + if (strlen(name) >= USHRT_MAX) + return 0; #ifdef XCMS /* * Let's Attempt to use Xcms approach to Parse Color @@ -76,7 +79,7 @@ int flags) /* DoRed, DoGreen, DoBlue */ req->cmap = cmap; req->flags = flags; req->pixel = pixel; - req->nbytes = nbytes = strlen(name); + req->nbytes = (CARD16) (nbytes = (unsigned) strlen(name)); req->length += (nbytes + 3) >> 2; /* round up to multiple of 4 */ Data(dpy, name, (long)nbytes); UnlockDisplay(dpy); diff --git a/src/StName.c b/src/StName.c index b4048bff..04bb3aa6 100644 --- a/src/StName.c +++ b/src/StName.c @@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. #ifdef HAVE_CONFIG_H #include #endif +#include #include #include @@ -36,9 +37,11 @@ XStoreName ( Window w, _Xconst char *name) { - return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, + if (strlen(name) >= USHRT_MAX) + return 0; + return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */ 8, PropModeReplace, (_Xconst unsigned char *)name, - name ? strlen(name) : 0); + name ? (int) strlen(name) : 0); } int @@ -47,7 +50,9 @@ XSetIconName ( Window w, _Xconst char *icon_name) { + if (strlen(icon_name) >= USHRT_MAX) + return 0; return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8, PropModeReplace, (_Xconst unsigned char *)icon_name, - icon_name ? strlen(icon_name) : 0); + icon_name ? (int) strlen(icon_name) : 0); } -- 2.30.1