File U_Xi-Do-not-try-to-swap-GenericEvent.patch of Package xorg-x11-server

Overview Repositories Revisions Requests Users Attributes Meta

File U_Xi-Do-not-try-to-swap-GenericEvent.patch of Package xorg-x11-server (Revision 6681853866b2262167ee5497daca6adc)

Currently displaying revision 6681853866b2262167ee5497daca6adc , Show latest

Author: Michal Srb <msrb@suse.com>
Subject: Xi: Do not try to swap GenericEvent.
Git-commit: ba336b24052122b136486961c82deac76bbde455
Patch-mainline: Upstream
References: bnc#1035283 CVE-2017-10971

The SProcXSendExtensionEvent must not attempt to swap GenericEvent because
it is assuming that the event has fixed size and gives the swapping function
xEvent-sized buffer.

A GenericEvent would be later rejected by ProcXSendExtensionEvent anyway.

Signed-off-by: Michal Srb <msrb@suse.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 Xi/sendexev.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index 5e63bfcca..5c2e0fc56 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client)
 
     eventP = (xEvent *) &stuff[1];
     for (i = 0; i < stuff->num_events; i++, eventP++) {
+        if (eventP->u.u.type == GenericEvent) {
+            client->errorValue = eventP->u.u.type;
+            return BadValue;
+        }
+
         proc = EventSwapVector[eventP->u.u.type & 0177];
-        if (proc == NotImplemented)     /* no swapping proc; invalid event type? */
+        /* no swapping proc; invalid event type? */
+        if (proc == NotImplemented) {
+            client->errorValue = eventP->u.u.type;
             return BadValue;
+        }
         (*proc) (eventP, &eventT);
         *eventP = eventT;
     }
-- 
2.12.0

Places

File U_Xi-Do-not-try-to-swap-GenericEvent.patch of Package xorg-x11-server (Revision 6681853866b2262167ee5497daca6adc)

Places