From c5114475db18f29d639537d60e135bdfc11a5d3a Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Thu, 28 Nov 2024 14:09:04 +0100 Subject: [PATCH xserver] xkb: Fix buffer overflow in XkbChangeTypesOfKey() If XkbChangeTypesOfKey() is called with nGroups == 0, it will resize the key syms to 0 but leave the key actions unchanged. If later, the same function is called with a non-zero value for nGroups, this will cause a buffer overflow because the key actions are of the wrong size. To avoid the issue, make sure to resize both the key syms and key actions when nGroups is 0. CVE-2025-26597, ZDI-CAN-25683 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative Signed-off-by: Olivier Fourdan Reviewed-by: Peter Hutterer --- xkb/XKBMisc.c | 1 + 1 file changed, 1 insertion(+) Index: xwayland-24.1.4/xkb/XKBMisc.c =================================================================== --- xwayland-24.1.4.orig/xkb/XKBMisc.c +++ xwayland-24.1.4/xkb/XKBMisc.c @@ -552,6 +552,7 @@ XkbChangeTypesOfKey(XkbDescPtr xkb, i = XkbSetNumGroups(i, 0); xkb->map->key_sym_map[key].group_info = i; XkbResizeKeySyms(xkb, key, 0); + XkbResizeKeyActions(xkb, key, 0); return Success; }