diff --git a/U_bsc1217765-Xi-allocate-enough-XkbActions-for-our-buttons.patch b/U_bsc1217765-Xi-allocate-enough-XkbActions-for-our-buttons.patch index 4bf7b21..94c4b69 100644 --- a/U_bsc1217765-Xi-allocate-enough-XkbActions-for-our-buttons.patch +++ b/U_bsc1217765-Xi-allocate-enough-XkbActions-for-our-buttons.patch @@ -14,37 +14,33 @@ CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative --- - Xi/exevents.c | 8 ++++++-- - dix/devices.c | 11 +++++++++++ - 2 files changed, 17 insertions(+), 2 deletions(-) - -diff --git a/Xi/exevents.c b/Xi/exevents.c -index dcd4efb3bc..f24de9eec4 100644 ---- a/Xi/exevents.c -+++ b/Xi/exevents.c -@@ -612,12 +612,16 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + Xi/exevents.c | 12 ++++++------ + dix/devices.c | 10 ++++++++++ + 2 files changed, 16 insertions(+), 6 deletions(-) +--- a/Xi/exevents.c ++++ a/Xi/exevents.c +@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + } if (from->button->xkb_acts) { - if (!to->button->xkb_acts) { +- if (!to->button->xkb_acts) { - to->button->xkb_acts = calloc(1, sizeof(XkbAction)); -+ to->button->xkb_acts = calloc(from->button->numButtons, sizeof(XkbAction)); - if (!to->button->xkb_acts) - FatalError("[Xi] not enough memory for xkb_acts.\n"); -+ } else { -+ to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts, -+ from->button->numButtons, -+ sizeof(XkbAction)); - } +- if (!to->button->xkb_acts) +- FatalError("[Xi] not enough memory for xkb_acts.\n"); +- } ++ size_t maxbuttons = max(to->button->numButtons, from->button->numButtons); ++ to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts, ++ maxbuttons, ++ sizeof(XkbAction)); ++ memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction)); memcpy(to->button->xkb_acts, from->button->xkb_acts, - sizeof(XkbAction)); + from->button->numButtons * sizeof(XkbAction)); } else { free(to->button->xkb_acts); -diff --git a/dix/devices.c b/dix/devices.c -index 7150734a58..deb3010206 100644 ---- a/dix/devices.c -+++ b/dix/devices.c +--- a/dix/devices.c ++++ a/dix/devices.c @@ -2530,6 +2530,8 @@ RecalculateMasterButtons(DeviceIntPtr slave) if (master->button && master->button->numButtons != maxbuttons) { @@ -54,7 +50,7 @@ index 7150734a58..deb3010206 100644 DeviceChangedEvent event = { .header = ET_Internal, .type = ET_DeviceChanged, -@@ -2540,6 +2542,15 @@ RecalculateMasterButtons(DeviceIntPtr slave) +@@ -2540,6 +2542,14 @@ RecalculateMasterButtons(DeviceIntPtr slave) }; master->button->numButtons = maxbuttons; @@ -66,10 +62,7 @@ index 7150734a58..deb3010206 100644 + 0, + (maxbuttons - last_num_buttons) * sizeof(XkbAction)); + } -+ memcpy(&event.buttons.names, master->button->labels, maxbuttons * sizeof(Atom)); -- -2.43.0 -