|
 |
3f8e74 |
From 6bb8aeb30a2686facc48733016caade97ece10ad Mon Sep 17 00:00:00 2001
|
|
|
3f8e74 |
From: Povilas Kanapickas <povilas@radix.lt>
|
|
|
3f8e74 |
Date: Tue, 14 Dec 2021 15:00:01 +0200
|
|
|
3f8e74 |
Subject: [PATCH xserver 2/4] xfixes: Fix out of bounds access in
|
|
|
3f8e74 |
*ProcXFixesCreatePointerBarrier()
|
|
|
3f8e74 |
|
|
|
3f8e74 |
ZDI-CAN-14950, CVE-2021-4009
|
|
|
3f8e74 |
|
|
|
3f8e74 |
This vulnerability was discovered and the fix was suggested by:
|
|
|
3f8e74 |
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
|
|
3f8e74 |
|
|
|
3f8e74 |
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
|
|
|
3f8e74 |
(cherry picked from commit b5196750099ae6ae582e1f46bd0a6dad29550e02)
|
|
|
3f8e74 |
---
|
|
|
3f8e74 |
xfixes/cursor.c | 6 ++++--
|
|
|
3f8e74 |
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
3f8e74 |
|
|
|
3f8e74 |
diff --git a/xfixes/cursor.c b/xfixes/cursor.c
|
|
|
3f8e74 |
index d4b68f3af..5f531a89a 100644
|
|
|
3f8e74 |
--- a/xfixes/cursor.c
|
|
|
3f8e74 |
+++ b/xfixes/cursor.c
|
|
|
3f8e74 |
@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client)
|
|
|
3f8e74 |
{
|
|
|
3f8e74 |
REQUEST(xXFixesCreatePointerBarrierReq);
|
|
|
3f8e74 |
|
|
|
3f8e74 |
- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
|
|
|
3f8e74 |
+ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
|
|
|
3f8e74 |
+ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
|
|
|
3f8e74 |
LEGAL_NEW_RESOURCE(stuff->barrier, client);
|
|
|
3f8e74 |
|
|
|
3f8e74 |
return XICreatePointerBarrier(client, stuff);
|
|
|
3f8e74 |
@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client)
|
|
|
3f8e74 |
|
|
|
3f8e74 |
swaps(&stuff->length);
|
|
|
3f8e74 |
swaps(&stuff->num_devices);
|
|
|
3f8e74 |
- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
|
|
|
3f8e74 |
+ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
|
|
|
3f8e74 |
+ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
|
|
|
3f8e74 |
|
|
|
3f8e74 |
swapl(&stuff->barrier);
|
|
|
3f8e74 |
swapl(&stuff->window);
|
|
|
3f8e74 |
--
|
|
|
3f8e74 |
2.33.1
|
|
|
3f8e74 |
|