0007-fix-for-ZDI-11426.patch 1.2 KB

123456789101112131415161718192021222324252627282930313233343536
  1. From aac28e162e5108510065ad4c323affd6deffd816 Mon Sep 17 00:00:00 2001
  2. From: Matthieu Herrb <matthieu@herrb.eu>
  3. Date: Sat, 25 Jul 2020 19:33:50 +0200
  4. Subject: [PATCH] fix for ZDI-11426
  5. Avoid leaking un-initalized memory to clients by zeroing the
  6. whole pixmap on initial allocation.
  7. This vulnerability was discovered by:
  8. Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
  9. Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
  10. Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
  11. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
  12. [downloaded from upstream commit
  13. https://gitlab.freedesktop.org/xorg/xserver/-/commit/aac28e162e5108510065ad4c323affd6deffd816]
  14. ---
  15. dix/pixmap.c | 2 +-
  16. 1 file changed, 1 insertion(+), 1 deletion(-)
  17. diff --git a/dix/pixmap.c b/dix/pixmap.c
  18. index 1186d7dbbf..5a0146bbb6 100644
  19. --- a/dix/pixmap.c
  20. +++ b/dix/pixmap.c
  21. @@ -116,7 +116,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize)
  22. if (pScreen->totalPixmapSize > ((size_t) - 1) - pixDataSize)
  23. return NullPixmap;
  24. - pPixmap = malloc(pScreen->totalPixmapSize + pixDataSize);
  25. + pPixmap = calloc(1, pScreen->totalPixmapSize + pixDataSize);
  26. if (!pPixmap)
  27. return NullPixmap;
  28. --
  29. GitLab