aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs/Xserver/xkb
diff options
context:
space:
mode:
authorMike Gabriel <mike.gabriel@das-netzwerkteam.de>2021-01-15 17:00:42 +0100
committerMike Gabriel <mike.gabriel@das-netzwerkteam.de>2021-01-15 17:00:42 +0100
commit1257561577cd8227f3534fc44b72a1239aba363c (patch)
tree80f5ab687df5992d1c9a6e661ce6e087e48b7486 /nx-X11/programs/Xserver/xkb
parent013a6ba3c500ead26e4210699d177f4b485ceb7d (diff)
downloadnx-libs-1257561577cd8227f3534fc44b72a1239aba363c.tar.gz
nx-libs-1257561577cd8227f3534fc44b72a1239aba363c.tar.bz2
nx-libs-1257561577cd8227f3534fc44b72a1239aba363c.zip
Revert "CVE-2020-14360: Check SetMap request length carefully."
This reverts commit 4eba4f53ad8c62c27c12835e58184d66121ff636.
Diffstat (limited to 'nx-X11/programs/Xserver/xkb')
-rw-r--r--nx-X11/programs/Xserver/xkb/xkb.c91
1 files changed, 0 insertions, 91 deletions
diff --git a/nx-X11/programs/Xserver/xkb/xkb.c b/nx-X11/programs/Xserver/xkb/xkb.c
index 654b33fe7..7b392fa09 100644
--- a/nx-X11/programs/Xserver/xkb/xkb.c
+++ b/nx-X11/programs/Xserver/xkb/xkb.c
@@ -2202,92 +2202,6 @@ XkbServerMapPtr srv = xkbi->desc->server;
return (char *)wire;
}
-#define _add_check_len(new) \
- if (len > UINT32_MAX - (new) || len > req_len - (new)) goto bad; \
- else len += new
-
-/**
- * Check the length of the SetMap request
- */
-static int
-_XkbSetMapCheckLength(xkbSetMapReq *req)
-{
- size_t len = sz_xkbSetMapReq, req_len = req->length << 2;
- xkbKeyTypeWireDesc *keytype;
- xkbSymMapWireDesc *symmap;
- BOOL preserve;
- int i, map_count, nSyms;
-
- if (req_len < len)
- goto bad;
- /* types */
- if (req->present & XkbKeyTypesMask) {
- keytype = (xkbKeyTypeWireDesc *)(req + 1);
- for (i = 0; i < req->nTypes; i++) {
- _add_check_len(XkbPaddedSize(sz_xkbKeyTypeWireDesc));
- if (req->flags & XkbSetMapResizeTypes) {
- _add_check_len(keytype->nMapEntries
- * sz_xkbKTSetMapEntryWireDesc);
- preserve = keytype->preserve;
- map_count = keytype->nMapEntries;
- if (preserve) {
- _add_check_len(map_count * sz_xkbModsWireDesc);
- }
- keytype += 1;
- keytype = (xkbKeyTypeWireDesc *)
- ((xkbKTSetMapEntryWireDesc *)keytype + map_count);
- if (preserve)
- keytype = (xkbKeyTypeWireDesc *)
- ((xkbModsWireDesc *)keytype + map_count);
- }
- }
- }
- /* syms */
- if (req->present & XkbKeySymsMask) {
- symmap = (xkbSymMapWireDesc *)((char *)req + len);
- for (i = 0; i < req->nKeySyms; i++) {
- _add_check_len(sz_xkbSymMapWireDesc);
- nSyms = symmap->nSyms;
- _add_check_len(nSyms*sizeof(CARD32));
- symmap += 1;
- symmap = (xkbSymMapWireDesc *)((CARD32 *)symmap + nSyms);
- }
- }
- /* actions */
- if (req->present & XkbKeyActionsMask) {
- _add_check_len(req->totalActs * sz_xkbActionWireDesc
- + XkbPaddedSize(req->nKeyActs));
- }
- /* behaviours */
- if (req->present & XkbKeyBehaviorsMask) {
- _add_check_len(req->totalKeyBehaviors * sz_xkbBehaviorWireDesc);
- }
- /* vmods */
- if (req->present & XkbVirtualModsMask) {
- _add_check_len(XkbPaddedSize(Ones(req->virtualMods)));
- }
- /* explicit */
- if (req->present & XkbExplicitComponentsMask) {
- /* two bytes per non-zero explicit componen */
- _add_check_len(XkbPaddedSize(req->totalKeyExplicit * sizeof(CARD16)));
- }
- /* modmap */
- if (req->present & XkbModifierMapMask) {
- /* two bytes per non-zero modmap component */
- _add_check_len(XkbPaddedSize(req->totalModMapKeys * sizeof(CARD16)));
- }
- /* vmodmap */
- if (req->present & XkbVirtualModMapMask) {
- _add_check_len(req->totalVModMapKeys * sz_xkbVModMapWireDesc);
- }
- if (len == req_len)
- return Success;
-bad:
- ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
- len, req_len);
- return BadLength;
-}
-
int
ProcXkbSetMap(ClientPtr client)
{
@@ -2311,11 +2225,6 @@ ProcXkbSetMap(ClientPtr client)
CHK_KBD_DEVICE(dev,stuff->deviceSpec);
CHK_MASK_LEGAL(0x01,stuff->present,XkbAllMapComponentsMask);
- /* first verify the request length carefully */
- rc = _XkbSetMapCheckLength(stuff);
- if (rc != Success)
- return rc;
-
XkbSetCauseXkbReq(&cause,X_kbSetMap,client);
xkbi= dev->key->xkbInfo;
xkb = xkbi->desc;