aboutsummaryrefslogtreecommitdiff
path: root/nx-X11
diff options
context:
space:
mode:
authorOlivier Fourdan <ofourdan@redhat.com>2015-01-16 20:08:59 +0100
committerMike DePaulo <mikedep333@gmail.com>2015-02-17 21:24:28 -0500
commit9308c79ba2757cb1a64e0040176b8290b435544f (patch)
treed409f4e736836ca755e8745b0c2b9e00171c34cd /nx-X11
parent3937db18a203f9936387286b95328f27013a5ffe (diff)
downloadnx-libs-9308c79ba2757cb1a64e0040176b8290b435544f.tar.gz
nx-libs-9308c79ba2757cb1a64e0040176b8290b435544f.tar.bz2
nx-libs-9308c79ba2757cb1a64e0040176b8290b435544f.zip
xkb: Don't swap XkbSetGeometry data in the input buffer
The XkbSetGeometry request embeds data which needs to be swapped when the server and the client have different endianess. _XkbSetGeometry() invokes functions that swap these data directly in the input buffer. However, ProcXkbSetGeometry() may call _XkbSetGeometry() more than once (if there is more than one keyboard), thus causing on swapped clients the same data to be swapped twice in memory, further causing a server crash because the strings lengths on the second time are way off bounds. To allow _XkbSetGeometry() to run reliably more than once with swapped clients, do not swap the data in the buffer, use variables instead. v3: backport to nx-libs 3.6.x as a prereq for the CVE-2015-0255 fix (Mike DePaulo) Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> (cherry picked from commit 81c90dc8f0aae3b65730409b1b615b5fa7280ebd) (cherry picked from commit 29be310c303914090298ddda93a5bd5d00a94945) Signed-off-by: Julien Cristau <jcristau@debian.org> index 2405090..7db0959 100644
Diffstat (limited to 'nx-X11')
-rw-r--r--nx-X11/programs/Xserver/xkb/xkb.c35
1 files changed, 19 insertions, 16 deletions
diff --git a/nx-X11/programs/Xserver/xkb/xkb.c b/nx-X11/programs/Xserver/xkb/xkb.c
index 2561c8959..d8b5b2ce1 100644
--- a/nx-X11/programs/Xserver/xkb/xkb.c
+++ b/nx-X11/programs/Xserver/xkb/xkb.c
@@ -4441,15 +4441,14 @@ static char *
_GetCountedString(char **wire_inout,Bool swap)
{
char * wire,*str;
-CARD16 len,*plen;
+CARD16 len;
wire= *wire_inout;
- plen= (CARD16 *)wire;
+ len= (CARD16 *)wire;
if (swap) {
register int n;
- swaps(plen,n);
+ swaps(&len, n);
}
- len= *plen;
str= (char *)_XkbAlloc(len+1);
if (str) {
memcpy(str,&wire[2],len);
@@ -4468,26 +4467,29 @@ _CheckSetDoodad( char ** wire_inout,
{
char * wire;
xkbDoodadWireDesc * dWire;
+xkbAnyDoodadWireDesc any;
+xkbTextDoodadWireDesc text;
XkbDoodadPtr doodad;
dWire= (xkbDoodadWireDesc *)(*wire_inout);
+ any = dWire->any;
wire= (char *)&dWire[1];
if (client->swapped) {
register int n;
- swapl(&dWire->any.name,n);
- swaps(&dWire->any.top,n);
- swaps(&dWire->any.left,n);
- swaps(&dWire->any.angle,n);
+ swapl(&any.name, n);
+ swaps(&any.top, n);
+ swaps(&any.left, n);
+ swaps(&any.angle, n);
}
CHK_ATOM_ONLY(dWire->any.name);
- doodad= XkbAddGeomDoodad(geom,section,dWire->any.name);
+ doodad = XkbAddGeomDoodad(geom, section, any.name);
if (!doodad)
return BadAlloc;
doodad->any.type= dWire->any.type;
doodad->any.priority= dWire->any.priority;
- doodad->any.top= dWire->any.top;
- doodad->any.left= dWire->any.left;
- doodad->any.angle= dWire->any.angle;
+ doodad->any.top = any.top;
+ doodad->any.left = any.left;
+ doodad->any.angle = any.angle;
switch (doodad->any.type) {
case XkbOutlineDoodad:
case XkbSolidDoodad:
@@ -4510,13 +4512,14 @@ XkbDoodadPtr doodad;
dWire->text.colorNdx);
return BadMatch;
}
+ text = dWire->text;
if (client->swapped) {
register int n;
- swaps(&dWire->text.width,n);
- swaps(&dWire->text.height,n);
+ swaps(&text.width, n);
+ swaps(&text.height, n);
}
- doodad->text.width= dWire->text.width;
- doodad->text.height= dWire->text.height;
+ doodad->text.width= text.width;
+ doodad->text.height= text.height;
doodad->text.color_ndx= dWire->text.colorNdx;
doodad->text.text= _GetCountedString(&wire,client->swapped);
doodad->text.font= _GetCountedString(&wire,client->swapped);