1
0
xorg-x11-server/U_Xi-Do-not-try-to-swap-GenericEvent.patch
Michal Srb 56414dbfb1 Accepting request 508727 from home:michalsrb:branches:X11:XOrg
- u_Xi-Do-not-try-to-swap-GenericEvent.patch,
  u_Xi-Verify-all-events-in-ProcXSendExtensionEvent.patch,
  u_Xi-Zero-target-buffer-in-SProcXSendExtensionEvent.patch,
  u_dix-Disallow-GenericEvent-in-SendEvent-request.patch
  * Fix security issues in event handling. (bnc#1035283,
    CVE-2017-10971, CVE-2017-10972)

OBS-URL: https://build.opensuse.org/request/show/508727
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xorg-x11-server?expand=0&rev=668
2017-07-07 09:24:38 +00:00

45 lines
1.4 KiB
Diff

Author: Michal Srb <msrb@suse.com>
Subject: Xi: Do not try to swap GenericEvent.
Git-commit: ba336b24052122b136486961c82deac76bbde455
Patch-mainline: Upstream
References: bnc#1035283 CVE-2017-10971
The SProcXSendExtensionEvent must not attempt to swap GenericEvent because
it is assuming that the event has fixed size and gives the swapping function
xEvent-sized buffer.
A GenericEvent would be later rejected by ProcXSendExtensionEvent anyway.
Signed-off-by: Michal Srb <msrb@suse.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
---
Xi/sendexev.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index 5e63bfcca..5c2e0fc56 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client)
eventP = (xEvent *) &stuff[1];
for (i = 0; i < stuff->num_events; i++, eventP++) {
+ if (eventP->u.u.type == GenericEvent) {
+ client->errorValue = eventP->u.u.type;
+ return BadValue;
+ }
+
proc = EventSwapVector[eventP->u.u.type & 0177];
- if (proc == NotImplemented) /* no swapping proc; invalid event type? */
+ /* no swapping proc; invalid event type? */
+ if (proc == NotImplemented) {
+ client->errorValue = eventP->u.u.type;
return BadValue;
+ }
(*proc) (eventP, &eventT);
*eventP = eventT;
}
--
2.12.0