From eff3f6cdd398bfac040351e99e64baf3bf64fa2e Mon Sep 17 00:00:00 2001 From: Matthieu Herrb Date: Tue, 18 Aug 2020 14:49:04 +0200 Subject: [PATCH xserver] Fix XIChangeHierarchy() integer underflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2020-14346 / ZDI-CAN-11429 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative Signed-off-by: Matthieu Herrb (cherry picked from commit 1e3392b07923987c6c9d09cf75b24f397b59bd5e) Signed-off-by: Michel Dänzer --- Xi/xichangehierarchy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c index cbdd91258..504defe56 100644 --- a/Xi/xichangehierarchy.c +++ b/Xi/xichangehierarchy.c @@ -423,7 +423,7 @@ ProcXIChangeHierarchy(ClientPtr client) if (!stuff->num_changes) return rc; - len = ((size_t)stuff->length << 2) - sizeof(xXIChangeHierarchyReq); + len = ((size_t)client->req_len << 2) - sizeof(xXIChangeHierarchyReq); any = (xXIAnyHierarchyChangeInfo *) &stuff[1]; while (stuff->num_changes--) { -- 2.28.0