2015d83dd5
Add upstream patches fixing the following security issues: CVE-2017-10971: The endianess handling for X Events assumed a fixed size of X Event structures and had a specific 32 byte stack buffer for that. However "GenericEvents" can have any size, so if the events were sent in the wrong endianess, this stack buffer could be overflowed easily. So authenticated X users could overflow the stack in the X Server and with the X server usually running as root gaining root prileveges. CVE-2017-10972: An information leak out of the X server due to an uninitialized stack area when swapping event endianess. For more details, see the advisory: http://www.openwall.com/lists/oss-security/2017/07/06/6 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
51 lines
1.6 KiB
Diff
51 lines
1.6 KiB
Diff
From 8caed4df36b1f802b4992edcfd282cbeeec35d9d Mon Sep 17 00:00:00 2001
|
|
From: Michal Srb <msrb@suse.com>
|
|
Date: Wed, 24 May 2017 15:54:41 +0300
|
|
Subject: [PATCH] Xi: Verify all events in ProcXSendExtensionEvent.
|
|
|
|
The requirement is that events have type in range
|
|
EXTENSION_EVENT_BASE..lastEvent, but it was tested
|
|
only for first event of all.
|
|
|
|
Signed-off-by: Michal Srb <msrb@suse.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
---
|
|
Xi/sendexev.c | 12 +++++++-----
|
|
1 file changed, 7 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
|
|
index 1cf118ab6..5e63bfcca 100644
|
|
--- a/Xi/sendexev.c
|
|
+++ b/Xi/sendexev.c
|
|
@@ -117,7 +117,7 @@ SProcXSendExtensionEvent(ClientPtr client)
|
|
int
|
|
ProcXSendExtensionEvent(ClientPtr client)
|
|
{
|
|
- int ret;
|
|
+ int ret, i;
|
|
DeviceIntPtr dev;
|
|
xEvent *first;
|
|
XEventClass *list;
|
|
@@ -141,10 +141,12 @@ ProcXSendExtensionEvent(ClientPtr client)
|
|
/* The client's event type must be one defined by an extension. */
|
|
|
|
first = ((xEvent *) &stuff[1]);
|
|
- if (!((EXTENSION_EVENT_BASE <= first->u.u.type) &&
|
|
- (first->u.u.type < lastEvent))) {
|
|
- client->errorValue = first->u.u.type;
|
|
- return BadValue;
|
|
+ for (i = 0; i < stuff->num_events; i++) {
|
|
+ if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) &&
|
|
+ (first[i].u.u.type < lastEvent))) {
|
|
+ client->errorValue = first[i].u.u.type;
|
|
+ return BadValue;
|
|
+ }
|
|
}
|
|
|
|
list = (XEventClass *) (first + stuff->num_events);
|
|
--
|
|
2.11.0
|
|
|