mirror of
https://git.yoctoproject.org/poky
synced 2026-05-01 06:32:11 +02:00
d0fd4d9160
import patch from debian to fix
CVE-2025-49179
Upstream-Status: Backport [import from debian xorg-server_21.1.7-3+deb12u10.diff.gz
Upstream commit 2bde9ca49a]
(From OE-Core rev: da1b72e407190a81ac3bcc74a0ea51b4160cb5a9)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
68 lines
2.4 KiB
Diff
68 lines
2.4 KiB
Diff
From 2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4 Mon Sep 17 00:00:00 2001
|
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
Date: Mon, 28 Apr 2025 11:47:15 +0200
|
|
Subject: [PATCH] record: Check for overflow in
|
|
RecordSanityCheckRegisterClients()
|
|
|
|
The RecordSanityCheckRegisterClients() checks for the request length,
|
|
but does not check for integer overflow.
|
|
|
|
A client might send a very large value for either the number of clients
|
|
or the number of protocol ranges that will cause an integer overflow in
|
|
the request length computation, defeating the check for request length.
|
|
|
|
To avoid the issue, explicitly check the number of clients against the
|
|
limit of clients (which is much lower than an maximum integer value) and
|
|
the number of protocol ranges (multiplied by the record length) do not
|
|
exceed the maximum integer value.
|
|
|
|
This way, we ensure that the final computation for the request length
|
|
will not overflow the maximum integer limit.
|
|
|
|
CVE-2025-49179
|
|
|
|
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
|
|
reported by Julian Suleder via ERNW Vulnerability Disclosure.
|
|
|
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
|
|
|
|
Upstream-Status: Backport [import from debian xorg-server_21.1.7-3+deb12u10.diff.gz
|
|
Upstream commit https://gitlab.freedesktop.org/xorg/xserver/-/commit/2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4]
|
|
CVE: CVE-2025-49179
|
|
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
|
---
|
|
record/record.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/record/record.c b/record/record.c
|
|
index e123867..d57be5b 100644
|
|
--- a/record/record.c
|
|
+++ b/record/record.c
|
|
@@ -45,6 +45,7 @@ and Jim Haggerty of Metheus.
|
|
#include "inputstr.h"
|
|
#include "eventconvert.h"
|
|
#include "scrnintstr.h"
|
|
+#include "opaque.h"
|
|
|
|
#include <stdio.h>
|
|
#include <assert.h>
|
|
@@ -1298,6 +1299,13 @@ RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client,
|
|
int i;
|
|
XID recordingClient;
|
|
|
|
+ /* LimitClients is 2048 at max, way less that MAXINT */
|
|
+ if (stuff->nClients > LimitClients)
|
|
+ return BadValue;
|
|
+
|
|
+ if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange))
|
|
+ return BadValue;
|
|
+
|
|
if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) !=
|
|
4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges)
|
|
return BadLength;
|
|
--
|
|
2.25.1
|
|
|