forked from pool/xorg-x11-server
Stefan Dirsch
97f1555e30
* CVE-2021-4009/ZDI-CAN-14950 (bsc#1190487)
The handler for the CreatePointerBarrier request of the XFixes
extension does not properly validate the request length leading
to out of bounds memory write.
- U_Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch
* CVE-2021-4010/ZDI-CAN-14951 (bsc#1190488)
The handler for the Suspend request of the Screen Saver extension
does not properly validate the request length leading to out of
bounds memory write.
- U_record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
* CVE-2021-4011/ZDI-CAN-14952 (bsc#1190489)
The handlers for the RecordCreateContext and RecordRegisterClients
requests of the Record extension do not properly validate the request
length leading to out of bounds memory write.
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xorg-x11-server?expand=0&rev=811
34 lines
1.1 KiB
Diff
34 lines
1.1 KiB
Diff
From e56f61c79fc3cee26d83cda0f84ae56d5979f768 Mon Sep 17 00:00:00 2001
|
|
From: Povilas Kanapickas <povilas@radix.lt>
|
|
Date: Tue, 14 Dec 2021 15:00:00 +0200
|
|
Subject: [PATCH] record: Fix out of bounds access in SwapCreateRegister()
|
|
|
|
ZDI-CAN-14952, CVE-2021-4011
|
|
|
|
This vulnerability was discovered and the fix was suggested by:
|
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
|
|
|
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
|
|
---
|
|
record/record.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/record/record.c b/record/record.c
|
|
index be154525d..e123867a7 100644
|
|
--- a/record/record.c
|
|
+++ b/record/record.c
|
|
@@ -2516,8 +2516,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff)
|
|
swapl(pClientID);
|
|
}
|
|
if (stuff->nRanges >
|
|
- client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
|
|
- - stuff->nClients)
|
|
+ (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
|
|
+ - stuff->nClients) / bytes_to_int32(sz_xRecordRange))
|
|
return BadLength;
|
|
RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);
|
|
return Success;
|
|
--
|
|
2.26.2
|
|
|