0001-xkb-proof-GetCountedString-against-request-length-at.patch 1.1 KB

1234567891011121314151617181920212223242526272829303132333435363738
  1. CVE: CVE-2022-3550
  2. Upstream-Status: Backport
  3. Signed-off-by: Ross Burton <ross.burton@arm.com>
  4. From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001
  5. From: Peter Hutterer <peter.hutterer@who-t.net>
  6. Date: Tue, 5 Jul 2022 12:06:20 +1000
  7. Subject: [PATCH] xkb: proof GetCountedString against request length attacks
  8. GetCountedString did a check for the whole string to be within the
  9. request buffer but not for the initial 2 bytes that contain the length
  10. field. A swapped client could send a malformed request to trigger a
  11. swaps() on those bytes, writing into random memory.
  12. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
  13. ---
  14. xkb/xkb.c | 5 +++++
  15. 1 file changed, 5 insertions(+)
  16. diff --git a/xkb/xkb.c b/xkb/xkb.c
  17. index f42f59ef3..1841cff26 100644
  18. --- a/xkb/xkb.c
  19. +++ b/xkb/xkb.c
  20. @@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str)
  21. CARD16 len;
  22. wire = *wire_inout;
  23. +
  24. + if (client->req_len <
  25. + bytes_to_int32(wire + 2 - (char *) client->requestBuffer))
  26. + return BadValue;
  27. +
  28. len = *(CARD16 *) wire;
  29. if (client->swapped) {
  30. swaps(&len);
  31. --
  32. 2.34.1