Stefan Dirsch
64a4180db5
* Out-of-bounds access in X Rendering extension (Animated cursors)
(CVE-2025-49175, bsc#1244082)
- U_CVE-2025-49176-os-Do-not-overflow-the-integer-size-with-BigRequest.patch
* Integer overflow in Big Requests Extension
(CVE-2025-49176, bsc#1244084)
- U_CVE-2025-49177-xfixes-Check-request-length-for-SetClientDisconnectM.patch
* Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode)
(CVE-2025-49177, bsc#1244085)
- U_CVE-2025-49178-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch
* Unprocessed client request via bytes to ignore
(CVE-2025-49178, bsc#1244087)
- U_CVE-2025-49179-record-Check-for-overflow-in-RecordSanityCheckRegist.patch
* Integer overflow in X Record extension
(CVE-2025-49179, bsc#1244089)
- U_CVE-2025-49180-randr-Check-for-overflow-in-RRChangeProviderProperty.patch
* Integer overflow in RandR extension (RRChangeProviderProperty)
(CVE-2025-49180, bsc#1244090)
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xwayland?expand=0&rev=102
129 lines
4.7 KiB
Diff
129 lines
4.7 KiB
Diff
From f0984082067f79b45383fa1eb889c6a901667331 Mon Sep 17 00:00:00 2001
|
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
Date: Mon, 20 Jan 2025 17:10:31 +0100
|
|
Subject: [PATCH xserver 4/4] sync: Apply changes last in
|
|
SyncChangeAlarmAttributes()
|
|
|
|
SyncChangeAlarmAttributes() would apply the various changes while
|
|
checking for errors.
|
|
|
|
If one of the changes triggers an error, the changes for the trigger,
|
|
counter or delta value would remain, possibly leading to inconsistent
|
|
changes.
|
|
|
|
Postpone the actual changes until we're sure nothing else can go wrong.
|
|
|
|
Related to CVE-2025-26601, ZDI-CAN-25870
|
|
|
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
---
|
|
Xext/sync.c | 42 +++++++++++++++++++++++++++---------------
|
|
1 file changed, 27 insertions(+), 15 deletions(-)
|
|
|
|
diff --git a/Xext/sync.c b/Xext/sync.c
|
|
index c36de1a2e..e282e6657 100644
|
|
--- a/Xext/sync.c
|
|
+++ b/Xext/sync.c
|
|
@@ -800,8 +800,14 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
|
|
int status;
|
|
XSyncCounter counter;
|
|
Mask origmask = mask;
|
|
+ SyncTrigger trigger;
|
|
+ Bool select_events_changed = FALSE;
|
|
+ Bool select_events_value;
|
|
+ int64_t delta;
|
|
|
|
- counter = pAlarm->trigger.pSync ? pAlarm->trigger.pSync->id : None;
|
|
+ trigger = pAlarm->trigger;
|
|
+ delta = pAlarm->delta;
|
|
+ counter = trigger.pSync ? trigger.pSync->id : None;
|
|
|
|
while (mask) {
|
|
int index2 = lowbit(mask);
|
|
@@ -817,24 +823,24 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
|
|
case XSyncCAValueType:
|
|
mask &= ~XSyncCAValueType;
|
|
/* sanity check in SyncInitTrigger */
|
|
- pAlarm->trigger.value_type = *values++;
|
|
+ trigger.value_type = *values++;
|
|
break;
|
|
|
|
case XSyncCAValue:
|
|
mask &= ~XSyncCAValue;
|
|
- pAlarm->trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
|
|
+ trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
|
|
values += 2;
|
|
break;
|
|
|
|
case XSyncCATestType:
|
|
mask &= ~XSyncCATestType;
|
|
/* sanity check in SyncInitTrigger */
|
|
- pAlarm->trigger.test_type = *values++;
|
|
+ trigger.test_type = *values++;
|
|
break;
|
|
|
|
case XSyncCADelta:
|
|
mask &= ~XSyncCADelta;
|
|
- pAlarm->delta = ((int64_t)values[0] << 32) | values[1];
|
|
+ delta = ((int64_t)values[0] << 32) | values[1];
|
|
values += 2;
|
|
break;
|
|
|
|
@@ -844,10 +850,8 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
|
|
client->errorValue = *values;
|
|
return BadValue;
|
|
}
|
|
- status = SyncEventSelectForAlarm(pAlarm, client,
|
|
- (Bool) (*values++));
|
|
- if (status != Success)
|
|
- return status;
|
|
+ select_events_value = (Bool) (*values++);
|
|
+ select_events_changed = TRUE;
|
|
break;
|
|
|
|
default:
|
|
@@ -856,25 +860,33 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
|
|
}
|
|
}
|
|
|
|
+ if (select_events_changed) {
|
|
+ status = SyncEventSelectForAlarm(pAlarm, client, select_events_value);
|
|
+ if (status != Success)
|
|
+ return status;
|
|
+ }
|
|
+
|
|
/* "If the test-type is PositiveComparison or PositiveTransition
|
|
* and delta is less than zero, or if the test-type is
|
|
* NegativeComparison or NegativeTransition and delta is
|
|
* greater than zero, a Match error is generated."
|
|
*/
|
|
if (origmask & (XSyncCADelta | XSyncCATestType)) {
|
|
- if ((((pAlarm->trigger.test_type == XSyncPositiveComparison) ||
|
|
- (pAlarm->trigger.test_type == XSyncPositiveTransition))
|
|
- && pAlarm->delta < 0)
|
|
+ if ((((trigger.test_type == XSyncPositiveComparison) ||
|
|
+ (trigger.test_type == XSyncPositiveTransition))
|
|
+ && delta < 0)
|
|
||
|
|
- (((pAlarm->trigger.test_type == XSyncNegativeComparison) ||
|
|
- (pAlarm->trigger.test_type == XSyncNegativeTransition))
|
|
- && pAlarm->delta > 0)
|
|
+ (((trigger.test_type == XSyncNegativeComparison) ||
|
|
+ (trigger.test_type == XSyncNegativeTransition))
|
|
+ && delta > 0)
|
|
) {
|
|
return BadMatch;
|
|
}
|
|
}
|
|
|
|
/* postpone this until now, when we're sure nothing else can go wrong */
|
|
+ pAlarm->delta = delta;
|
|
+ pAlarm->trigger = trigger;
|
|
if ((status = SyncInitTrigger(client, &pAlarm->trigger, counter, RTCounter,
|
|
origmask & XSyncCAAllTrigger)) != Success)
|
|
return status;
|
|
--
|
|
2.48.1
|
|
|