0002-Xi-Zero-target-buffer-in-SProcXSendExtensionEvent.patch 1.2 KB

123456789101112131415161718192021222324252627282930313233343536373839
  1. From 05442de962d3dc624f79fc1a00eca3ffc5489ced Mon Sep 17 00:00:00 2001
  2. From: Michal Srb <msrb@suse.com>
  3. Date: Wed, 24 May 2017 15:54:39 +0300
  4. Subject: [PATCH] Xi: Zero target buffer in SProcXSendExtensionEvent.
  5. Make sure that the xEvent eventT is initialized with zeros, the same way as
  6. in SProcSendEvent.
  7. Some event swapping functions do not overwrite all 32 bytes of xEvent
  8. structure, for example XSecurityAuthorizationRevoked. Two cooperating
  9. clients, one swapped and the other not, can send
  10. XSecurityAuthorizationRevoked event to each other to retrieve old stack data
  11. from X server. This can be potentialy misused to go around ASLR or
  12. stack-protector.
  13. Signed-off-by: Michal Srb <msrb@suse.com>
  14. Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
  15. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
  16. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  17. ---
  18. Xi/sendexev.c | 2 +-
  19. 1 file changed, 1 insertion(+), 1 deletion(-)
  20. diff --git a/Xi/sendexev.c b/Xi/sendexev.c
  21. index 11d82029f..1cf118ab6 100644
  22. --- a/Xi/sendexev.c
  23. +++ b/Xi/sendexev.c
  24. @@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client)
  25. {
  26. CARD32 *p;
  27. int i;
  28. - xEvent eventT;
  29. + xEvent eventT = { .u.u.type = 0 };
  30. xEvent *eventP;
  31. EventSwapPtr proc;
  32. --
  33. 2.11.0