File u_Xi-Zero-target-buffer-in-SProcXSendExtensionE... of Package xorg-x11-server.5551

Overview Repositories Revisions Requests Users Attributes Meta

File u_Xi-Zero-target-buffer-in-SProcXSendExtensionEvent.patch of Package xorg-x11-server.5551

Author: Michal Srb <msrb@suse.com>
Subject: Xi: Zero target buffer in SProcXSendExtensionEvent.
Patch-mainline: To be upstreamed
References: bnc#1035283

Make sure that the xEvent eventT is initialized with zeros, the same way as
in SProcSendEvent.

Some event swapping functions do not overwrite all 32 bytes of xEvent
structure, for example XSecurityAuthorizationRevoked. Two cooperating
clients, one swapped and the other not, can send
XSecurityAuthorizationRevoked event to each other to retrieve old stack data
from X server. This can be potentialy misused to go around ASLR or
stack-protector.

Signed-off-by: Michal Srb <msrb@suse.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 Xi/sendexev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index 11d82029f..1cf118ab6 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 {
     CARD32 *p;
     int i;
-    xEvent eventT;
+    xEvent eventT = { .u.u.type = 0 };
     xEvent *eventP;
     EventSwapPtr proc;
 
-- 
2.12.0

Places

File u_Xi-Zero-target-buffer-in-SProcXSendExtensionEvent.patch of Package xorg-x11-server.5551

Places