From 36bcef5e5fd175e95ed4e0a014f6b1d8598b719d Mon Sep 17 00:00:00 2001

From: Ray Strode <rstrode@redhat.com>

Date: Mon, 4 Oct 2021 14:27:54 -0400

Subject: [PATCH] xkb: Drop check for XkbSetMapResizeTypes

Commit 446ff2d3177087b8173fa779fa5b77a2a128988b added checks to

prevalidate the size of incoming SetMap requests.

That commit checks for the XkbSetMapResizeTypes flag to be set before

allowing key types data to be processed.

key types data can be changed or even just sent wholesale unchanged

without the number of key types changing, however. The check for

XkbSetMapResizeTypes rejects those legitimate requests. In particular,

XkbChangeMap never sets XkbSetMapResizeTypes and so always fails now

any time XkbKeyTypesMask is in the changed mask.

This commit drops the check for XkbSetMapResizeTypes in flags when

prevalidating the request length.

---

 xkb/xkb.c | 26 ++++++++++++--------------

 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/xkb/xkb.c b/xkb/xkb.c

index 183d6ffa1..62dee9cb6 100644

--- a/xkb/xkb.c

+++ b/xkb/xkb.c

@@ -2378,75 +2378,73 @@ SetVirtualModMap(XkbSrvInfoPtr xkbi,

         }

         changes->map.first_vmodmap_key = first;

         changes->map.num_vmodmap_keys = (last - first) + 1;

     }

     return (char *) wire;

 }

 #define _add_check_len(new) \

     if (len > UINT32_MAX - (new) || len > req_len - (new)) goto bad; \

     else len += new

 /**

  * Check the length of the SetMap request

  */

 static int

 _XkbSetMapCheckLength(xkbSetMapReq *req)

 {

     size_t len = sz_xkbSetMapReq, req_len = req->length << 2;

     xkbKeyTypeWireDesc *keytype;

     xkbSymMapWireDesc *symmap;

     BOOL preserve;

     int i, map_count, nSyms;

     if (req_len < len)

         goto bad;

     /* types */

     if (req->present & XkbKeyTypesMask) {

         keytype = (xkbKeyTypeWireDesc *)(req + 1);

         for (i = 0; i < req->nTypes; i++) {

             _add_check_len(XkbPaddedSize(sz_xkbKeyTypeWireDesc));

-            if (req->flags & XkbSetMapResizeTypes) {

-                _add_check_len(keytype->nMapEntries

-                               * sz_xkbKTSetMapEntryWireDesc);

-                preserve = keytype->preserve;

-                map_count = keytype->nMapEntries;

-                if (preserve) {

-                    _add_check_len(map_count * sz_xkbModsWireDesc);

-                }

-                keytype += 1;

-                keytype = (xkbKeyTypeWireDesc *)

-                          ((xkbKTSetMapEntryWireDesc *)keytype + map_count);

-                if (preserve)

-                    keytype = (xkbKeyTypeWireDesc *)

-                              ((xkbModsWireDesc *)keytype + map_count);

+            _add_check_len(keytype->nMapEntries

+                           * sz_xkbKTSetMapEntryWireDesc);

+            preserve = keytype->preserve;

+            map_count = keytype->nMapEntries;

+            if (preserve) {

+                _add_check_len(map_count * sz_xkbModsWireDesc);

             }

+            keytype += 1;

+            keytype = (xkbKeyTypeWireDesc *)

+                      ((xkbKTSetMapEntryWireDesc *)keytype + map_count);

+            if (preserve)

+                keytype = (xkbKeyTypeWireDesc *)

+                          ((xkbModsWireDesc *)keytype + map_count);

         }

     }

     /* syms */

     if (req->present & XkbKeySymsMask) {

         symmap = (xkbSymMapWireDesc *)((char *)req + len);

         for (i = 0; i < req->nKeySyms; i++) {

             _add_check_len(sz_xkbSymMapWireDesc);

             nSyms = symmap->nSyms;

             _add_check_len(nSyms*sizeof(CARD32));

             symmap += 1;

             symmap = (xkbSymMapWireDesc *)((CARD32 *)symmap + nSyms);

         }

     }

     /* actions */

     if (req->present & XkbKeyActionsMask) {

         _add_check_len(req->totalActs * sz_xkbActionWireDesc 

                        + XkbPaddedSize(req->nKeyActs));

     }

     /* behaviours */

     if (req->present & XkbKeyBehaviorsMask) {

         _add_check_len(req->totalKeyBehaviors * sz_xkbBehaviorWireDesc);

     }

     /* vmods */

     if (req->present & XkbVirtualModsMask) {

         _add_check_len(XkbPaddedSize(Ones(req->virtualMods)));

     }

     /* explicit */

     if (req->present & XkbExplicitComponentsMask) {

         /* two bytes per non-zero explicit componen */

         _add_check_len(XkbPaddedSize(req->totalKeyExplicit * sizeof(CARD16)));

-- 

2.32.0