| From a326256a9a3a7fcf9826e5e4830d581215ff2e46 Mon Sep 17 00:00:00 2001 |
| From: Peter Hutterer <peter.hutterer@who-t.net> |
| Date: Tue, 5 Jul 2022 12:06:20 +1000 |
| Subject: [PATCH 4/5] xkb: proof GetCountedString against request length |
| GetCountedString did a check for the whole string to be within the |
| request buffer but not for the initial 2 bytes that contain the length |
| field. A swapped client could send a malformed request to trigger a |
| swaps() on those bytes, writing into random memory. |
| Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> |
| 1 file changed, 5 insertions(+) |
| diff --git a/xkb/xkb.c b/xkb/xkb.c |
| index 3363b1d68..1e098bbe3 100644 |
| @@ -5138,6 +5138,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) |
| + bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) |
| 2.38.1.431.g37b22c650d-goog |