From acc50e6097d51fec0c6c34d84c35018a50c52d5a Mon Sep 17 00:00:00 2001

From: Povilas Kanapickas <povilas@radix.lt>

Date: Tue, 14 Dec 2021 15:00:00 +0200

Subject: [PATCH xserver 1/4] record: Fix out of bounds access in

 SwapCreateRegister()

ZDI-CAN-14952, CVE-2021-4011

This vulnerability was discovered and the fix was suggested by:

Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Povilas Kanapickas <povilas@radix.lt>

(cherry picked from commit e56f61c79fc3cee26d83cda0f84ae56d5979f768)

---

 record/record.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/record/record.c b/record/record.c

index 05d751ac2..a8aec23bd 100644

--- a/record/record.c

+++ b/record/record.c

@@ -2515,8 +2515,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff)

         swapl(pClientID);

     }

     if (stuff->nRanges >

-        client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)

-        - stuff->nClients)

+        (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)

+        - stuff->nClients) / bytes_to_int32(sz_xRecordRange))

         return BadLength;

     RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);

     return Success;

-- 

2.33.1