mirror of
https://git.yoctoproject.org/poky
synced 2026-04-30 21:32:13 +02:00
0603438c81
Upstream-Status: Backport from96798fc196&3e77295f88(From OE-Core rev: 223950f9c748f89ee1b2a9df9cd77a0099e74581) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
50 lines
1.6 KiB
Diff
50 lines
1.6 KiB
Diff
From 96798fc1967491c80a4d0c8d9e0a80586cb2152b Mon Sep 17 00:00:00 2001
|
|
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
Date: Fri, 22 Mar 2024 18:51:45 -0700
|
|
Subject: [PATCH] Xi: ProcXIGetSelectedEvents needs to use unswapped length to
|
|
send reply
|
|
|
|
CVE-2024-31080
|
|
|
|
Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
|
|
Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
|
|
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
|
|
|
|
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/96798fc1967491c80a4d0c8d9e0a80586cb2152b]
|
|
CVE: CVE-2024-31080
|
|
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
|
---
|
|
Xi/xiselectev.c | 5 ++++-
|
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
|
|
index edcb8a0d36..ac14949871 100644
|
|
--- a/Xi/xiselectev.c
|
|
+++ b/Xi/xiselectev.c
|
|
@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
|
|
InputClientsPtr others = NULL;
|
|
xXIEventMask *evmask = NULL;
|
|
DeviceIntPtr dev;
|
|
+ uint32_t length;
|
|
|
|
REQUEST(xXIGetSelectedEventsReq);
|
|
REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
|
|
@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client)
|
|
}
|
|
}
|
|
|
|
+ /* save the value before SRepXIGetSelectedEvents swaps it */
|
|
+ length = reply.length;
|
|
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
|
|
|
|
if (reply.num_masks)
|
|
- WriteToClient(client, reply.length * 4, buffer);
|
|
+ WriteToClient(client, length * 4, buffer);
|
|
|
|
free(buffer);
|
|
return Success;
|
|
--
|
|
GitLab
|
|
|