aboutsummaryrefslogtreecommitdiff
path: root/libX11/src/xkb
diff options
context:
space:
mode:
Diffstat (limited to 'libX11/src/xkb')
-rw-r--r--libX11/src/xkb/XKBExtDev.c6
-rw-r--r--libX11/src/xkb/XKBGeom.c15
-rw-r--r--libX11/src/xkb/XKBGetMap.c33
-rw-r--r--libX11/src/xkb/XKBNames.c2
4 files changed, 48 insertions, 8 deletions
diff --git a/libX11/src/xkb/XKBExtDev.c b/libX11/src/xkb/XKBExtDev.c
index 353e769bf..dd383bc10 100644
--- a/libX11/src/xkb/XKBExtDev.c
+++ b/libX11/src/xkb/XKBExtDev.c
@@ -181,6 +181,9 @@ int tmp;
return tmp;
}
if (rep->nBtnsWanted>0) {
+ if (((unsigned short) rep->firstBtnWanted + rep->nBtnsWanted)
+ >= devi->num_btns)
+ goto BAILOUT;
act= &devi->btn_acts[rep->firstBtnWanted];
bzero((char *)act,(rep->nBtnsWanted*sizeof(XkbAction)));
}
@@ -190,6 +193,9 @@ int tmp;
goto BAILOUT;
if (rep->nBtnsRtrn>0) {
int size;
+ if (((unsigned short) rep->firstBtnRtrn + rep->nBtnsRtrn)
+ >= devi->num_btns)
+ goto BAILOUT;
act= &devi->btn_acts[rep->firstBtnRtrn];
size= rep->nBtnsRtrn*SIZEOF(xkbActionWireDesc);
if (!_XkbCopyFromReadBuffer(&buf,(char *)act,size))
diff --git a/libX11/src/xkb/XKBGeom.c b/libX11/src/xkb/XKBGeom.c
index 7594a3de4..7140a7247 100644
--- a/libX11/src/xkb/XKBGeom.c
+++ b/libX11/src/xkb/XKBGeom.c
@@ -364,12 +364,16 @@ Status rtrn;
}
ol->num_points= olWire->nPoints;
}
- if (shapeWire->primaryNdx!=XkbNoShape)
+ if ((shapeWire->primaryNdx!=XkbNoShape) &&
+ (shapeWire->primaryNdx < shapeWire->nOutlines))
shape->primary= &shape->outlines[shapeWire->primaryNdx];
- else shape->primary= NULL;
- if (shapeWire->approxNdx!=XkbNoShape)
+ else
+ shape->primary= NULL;
+ if ((shapeWire->approxNdx!=XkbNoShape) &&
+ (shapeWire->approxNdx < shapeWire->nOutlines))
shape->approx= &shape->outlines[shapeWire->approxNdx];
- else shape->approx= NULL;
+ else
+ shape->approx= NULL;
XkbComputeShapeBounds(shape);
}
return Success;
@@ -615,6 +619,9 @@ XkbGeometryPtr geom;
if (status==Success)
status= _XkbReadGeomKeyAliases(&buf,geom,rep);
left= _XkbFreeReadBuffer(&buf);
+ if ((rep->baseColorNdx > geom->num_colors) ||
+ (rep->labelColorNdx > geom->num_colors))
+ status = BadLength;
if ((status!=Success) || left || buf.error) {
if (status==Success)
status= BadLength;
diff --git a/libX11/src/xkb/XKBGetMap.c b/libX11/src/xkb/XKBGetMap.c
index 30fb62971..c73e655ae 100644
--- a/libX11/src/xkb/XKBGetMap.c
+++ b/libX11/src/xkb/XKBGetMap.c
@@ -151,9 +151,12 @@ XkbClientMapPtr map;
map= xkb->map;
if (map->key_sym_map==NULL) {
register int offset;
+ int size = xkb->max_key_code + 1;
XkbSymMapPtr oldMap;
xkbSymMapWireDesc *newMap;
- map->key_sym_map= _XkbTypedCalloc((xkb->max_key_code+1),XkbSymMapRec);
+ if (((unsigned short)rep->firstKeySym + rep->nKeySyms) > size)
+ return BadLength;
+ map->key_sym_map= _XkbTypedCalloc(size,XkbSymMapRec);
if (map->key_sym_map==NULL)
return BadAlloc;
if (map->syms==NULL) {
@@ -209,6 +212,8 @@ XkbClientMapPtr map;
KeySym * newSyms;
int tmp;
+ if (((unsigned short)rep->firstKeySym + rep->nKeySyms) > map->num_syms)
+ return BadLength;
oldMap = &map->key_sym_map[rep->firstKeySym];
for (i=0;i<(int)rep->nKeySyms;i++,oldMap++) {
newMap= (xkbSymMapWireDesc *)
@@ -264,6 +269,10 @@ Status ret = Success;
symMap = &info->map->key_sym_map[rep->firstKeyAct];
for (i=0;i<(int)rep->nKeyActs;i++,symMap++) {
if (numDesc[i]==0) {
+ if ((i + rep->firstKeyAct) > (info->max_key_code + 1)) {
+ ret = BadLength;
+ goto done;
+ }
info->server->key_acts[i+rep->firstKeyAct]= 0;
}
else {
@@ -296,8 +305,10 @@ register int i;
xkbBehaviorWireDesc *wire;
if ( rep->totalKeyBehaviors>0 ) {
+ int size = xkb->max_key_code + 1;
+ if ( ((int) rep->firstKeyBehavior + rep->nKeyBehaviors) > size)
+ return BadLength;
if ( xkb->server->behaviors == NULL ) {
- int size = xkb->max_key_code+1;
xkb->server->behaviors = _XkbTypedCalloc(size,XkbBehavior);
if (xkb->server->behaviors==NULL)
return BadAlloc;
@@ -309,7 +320,7 @@ xkbBehaviorWireDesc *wire;
for (i=0;i<rep->totalKeyBehaviors;i++) {
wire= (xkbBehaviorWireDesc *)_XkbGetReadBufferPtr(buf,
SIZEOF(xkbBehaviorWireDesc));
- if (wire==NULL)
+ if (wire==NULL || wire->key >= size)
return BadLength;
xkb->server->behaviors[wire->key].type= wire->type;
xkb->server->behaviors[wire->key].data= wire->data;
@@ -351,8 +362,10 @@ register int i;
unsigned char *wire;
if ( rep->totalKeyExplicit>0 ) {
+ int size = xkb->max_key_code + 1;
+ if ( ((int) rep->firstKeyExplicit + rep->nKeyExplicit) > size)
+ return BadLength;
if ( xkb->server->explicit == NULL ) {
- int size = xkb->max_key_code+1;
xkb->server->explicit = _XkbTypedCalloc(size,unsigned char);
if (xkb->server->explicit==NULL)
return BadAlloc;
@@ -366,6 +379,8 @@ unsigned char *wire;
if (!wire)
return BadLength;
for (i=0;i<rep->totalKeyExplicit;i++,wire+=2) {
+ if (wire[0] > xkb->max_key_code || wire[1] > xkb->max_key_code)
+ return BadLength;
xkb->server->explicit[wire[0]]= wire[1];
}
}
@@ -379,6 +394,9 @@ register int i;
unsigned char *wire;
if ( rep->totalModMapKeys>0 ) {
+ if ( ((int)rep->firstModMapKey + rep->nModMapKeys) >
+ (xkb->max_key_code + 1))
+ return BadLength;
if ((xkb->map->modmap==NULL)&&
(XkbAllocClientMap(xkb,XkbModifierMapMask,0)!=Success)) {
return BadAlloc;
@@ -391,6 +409,8 @@ unsigned char *wire;
if (!wire)
return BadLength;
for (i=0;i<rep->totalModMapKeys;i++,wire+=2) {
+ if (wire[0] > xkb->max_key_code || wire[1] > xkb->max_key_code)
+ return BadLength;
xkb->map->modmap[wire[0]]= wire[1];
}
}
@@ -405,6 +425,9 @@ xkbVModMapWireDesc * wire;
XkbServerMapPtr srv;
if ( rep->totalVModMapKeys>0 ) {
+ if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
+ > xkb->max_key_code + 1)
+ return BadLength;
if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
(XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {
return BadAlloc;
@@ -461,6 +484,8 @@ unsigned mask;
if ( xkb->device_spec == XkbUseCoreKbd )
xkb->device_spec= rep->deviceID;
+ if ( rep->maxKeyCode < rep->minKeyCode )
+ return BadImplementation;
xkb->min_key_code = rep->minKeyCode;
xkb->max_key_code = rep->maxKeyCode;
diff --git a/libX11/src/xkb/XKBNames.c b/libX11/src/xkb/XKBNames.c
index 0276c05b3..3a8860be7 100644
--- a/libX11/src/xkb/XKBNames.c
+++ b/libX11/src/xkb/XKBNames.c
@@ -180,6 +180,8 @@ _XkbReadGetNamesReply( Display * dpy,
nKeys= xkb->max_key_code+1;
names->keys= _XkbTypedCalloc(nKeys,XkbKeyNameRec);
}
+ if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code + 1)
+ goto BAILOUT;
if (names->keys!=NULL) {
if (!_XkbCopyFromReadBuffer(&buf,
(char *)&names->keys[rep->firstKey],
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 05:14:22 +0000