- U_Fix-XChangeFeedbackControl-request-underflow.patch

* Fix XChangeFeedbackControl() request underflow (CVE-2021-3472,
    ZDI-CAN-1259, bsc#1180128)

OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xorg-x11-server?expand=0&rev=789

U_Fix-XChangeFeedbackControl-request-underflow.patch

@@ -0,0 +1,33 @@
+From 00f8ce4dbeeb99ff8e5e9211d08058b11a1ac3c0 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Sun, 21 Mar 2021 18:38:57 +0100
+Subject: [PATCH xserver] Fix XChangeFeedbackControl() request underflow
+
+CVE-2021-3472 / ZDI-CAN-1259
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+---
+ Xi/chgfctl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git Xi/chgfctl.c Xi/chgfctl.c
+index 1de4da9ef..7a597e43d 100644
+--- Xi/chgfctl.c
++++ Xi/chgfctl.c
+@@ -464,8 +464,11 @@ ProcXChangeFeedbackControl(ClientPtr client)
+         break;
+     case StringFeedbackClass:
+     {
+-        xStringFeedbackCtl *f = ((xStringFeedbackCtl *) &stuff[1]);
++        xStringFeedbackCtl *f;
+ 
++        REQUEST_AT_LEAST_EXTRA_SIZE(xChangeFeedbackControlReq,
++                                    sizeof(xStringFeedbackCtl));
++        f = ((xStringFeedbackCtl *) &stuff[1]);
+         if (client->swapped) {
+             if (len < bytes_to_int32(sizeof(xStringFeedbackCtl)))
+                 return BadLength;
+

xorg-x11-server.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Apr 12 10:46:33 UTC 2021 - Stefan Dirsch <sndirsch@suse.com>
+
+- U_Fix-XChangeFeedbackControl-request-underflow.patch
+  * Fix XChangeFeedbackControl() request underflow (CVE-2021-3472,
+    ZDI-CAN-1259, bsc#1180128)
+
 -------------------------------------------------------------------
 Wed Mar  3 09:24:59 UTC 2021 - Stefan Dirsch <sndirsch@suse.com>
 

xorg-x11-server.spec

@@ -256,6 +256,8 @@ Patch1801:      U_Fix-segfault-on-probing-a-non-PCI-platform-device-on.patch
 
 Patch1900:      u_no-lto-for-tests.patch
 
+Patch1180128:   U_Fix-XChangeFeedbackControl-request-underflow.patch
+
 %description
 This package contains the X.Org Server.
 
@@ -407,6 +409,7 @@ sh %{SOURCE92} --verify . %{SOURCE91}
 %patch1600 -p1
 %patch1801 -p1
 %patch1900 -p1
+%patch1180128 -p0
 
 %build
 %global _lto_cflags %{?_lto_cflags} -ffat-lto-objects