56414dbfb1
- u_Xi-Do-not-try-to-swap-GenericEvent.patch,
u_Xi-Verify-all-events-in-ProcXSendExtensionEvent.patch,
u_Xi-Zero-target-buffer-in-SProcXSendExtensionEvent.patch,
u_dix-Disallow-GenericEvent-in-SendEvent-request.patch
* Fix security issues in event handling. (bnc#1035283,
CVE-2017-10971, CVE-2017-10972)
OBS-URL: https://build.opensuse.org/request/show/508727
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xorg-x11-server?expand=0&rev=668
50 lines
1.5 KiB
Diff
50 lines
1.5 KiB
Diff
Author: Michal Srb <msrb@suse.com>
|
|
Subject: Xi: Verify all events in ProcXSendExtensionEvent.
|
|
Git-commit: 8caed4df36b1f802b4992edcfd282cbeeec35d9d
|
|
Patch-mainline: Upstream
|
|
References: bnc#1035283 CVE-2017-10971
|
|
|
|
The requirement is that events have type in range
|
|
EXTENSION_EVENT_BASE..lastEvent, but it was tested
|
|
only for first event of all.
|
|
|
|
Signed-off-by: Michal Srb <msrb@suse.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
---
|
|
Xi/sendexev.c | 12 +++++++-----
|
|
1 file changed, 7 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
|
|
index 1cf118ab6..5e63bfcca 100644
|
|
--- a/Xi/sendexev.c
|
|
+++ b/Xi/sendexev.c
|
|
@@ -117,7 +117,7 @@ SProcXSendExtensionEvent(ClientPtr client)
|
|
int
|
|
ProcXSendExtensionEvent(ClientPtr client)
|
|
{
|
|
- int ret;
|
|
+ int ret, i;
|
|
DeviceIntPtr dev;
|
|
xEvent *first;
|
|
XEventClass *list;
|
|
@@ -141,10 +141,12 @@ ProcXSendExtensionEvent(ClientPtr client)
|
|
/* The client's event type must be one defined by an extension. */
|
|
|
|
first = ((xEvent *) &stuff[1]);
|
|
- if (!((EXTENSION_EVENT_BASE <= first->u.u.type) &&
|
|
- (first->u.u.type < lastEvent))) {
|
|
- client->errorValue = first->u.u.type;
|
|
- return BadValue;
|
|
+ for (i = 0; i < stuff->num_events; i++) {
|
|
+ if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) &&
|
|
+ (first[i].u.u.type < lastEvent))) {
|
|
+ client->errorValue = first[i].u.u.type;
|
|
+ return BadValue;
|
|
+ }
|
|
}
|
|
|
|
list = (XEventClass *) (first + stuff->num_events);
|
|
--
|
|
2.12.0
|
|
|