Blame SOURCES/0002-xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch

2936a4
From 3eb5445f6f7fa9f86de87adc768105d42bdbcf74 Mon Sep 17 00:00:00 2001
2936a4
From: Povilas Kanapickas <povilas@radix.lt>
2936a4
Date: Tue, 14 Dec 2021 15:00:01 +0200
2936a4
Subject: [PATCH xserver 2/4] xfixes: Fix out of bounds access in
2936a4
 *ProcXFixesCreatePointerBarrier()
2936a4
2936a4
ZDI-CAN-14950, CVE-2021-4009
2936a4
2936a4
This vulnerability was discovered and the fix was suggested by:
2936a4
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
2936a4
2936a4
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
2936a4
(cherry picked from commit b5196750099ae6ae582e1f46bd0a6dad29550e02)
2936a4
---
2936a4
 xfixes/cursor.c | 6 ++++--
2936a4
 1 file changed, 4 insertions(+), 2 deletions(-)
2936a4
2936a4
diff --git a/xfixes/cursor.c b/xfixes/cursor.c
2936a4
index 60580b88f..c5d4554b2 100644
2936a4
--- a/xfixes/cursor.c
2936a4
+++ b/xfixes/cursor.c
2936a4
@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client)
2936a4
 {
2936a4
     REQUEST(xXFixesCreatePointerBarrierReq);
2936a4
 
2936a4
-    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
2936a4
+    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
2936a4
+                       pad_to_int32(stuff->num_devices * sizeof(CARD16)));
2936a4
     LEGAL_NEW_RESOURCE(stuff->barrier, client);
2936a4
 
2936a4
     return XICreatePointerBarrier(client, stuff);
2936a4
@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client)
2936a4
 
2936a4
     swaps(&stuff->length);
2936a4
     swaps(&stuff->num_devices);
2936a4
-    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
2936a4
+    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
2936a4
+                       pad_to_int32(stuff->num_devices * sizeof(CARD16)));
2936a4
 
2936a4
     swapl(&stuff->barrier);
2936a4
     swapl(&stuff->window);
2936a4
-- 
2936a4
2.33.1
2936a4