diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2023-09-17 14:19:40 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2023-09-22 14:50:34 -0700 |
| commit | 6858d468d9ca55fb4c5fd70b223dbc78a3358a7f (patch) | |
| tree | 7167ed194913af443eaa44d978333dde524bee2b | |
| parent | 78b37accff1abbe713349d59fdefd963ffa04bbc (diff) | |
CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
Make sure we allocate enough memory in the first place, and
also handle error returns from _XkbReadBufferCopyKeySyms() when
it detects out-of-bounds issues.
Reported-by: Gregory James DUCK <gjduck@gmail.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
| -rw-r--r-- | src/xkb/XKBGetMap.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c index 2891d21e..31199e4a 100644 --- a/src/xkb/XKBGetMap.c +++ b/src/xkb/XKBGetMap.c @@ -182,7 +182,8 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) if (offset + newMap->nSyms >= map->size_syms) { register int sz; - sz = map->size_syms + 128; + sz = offset + newMap->nSyms; + sz = ((sz + (unsigned) 128) / 128) * 128; _XkbResizeArray(map->syms, map->size_syms, sz, KeySym); if (map->syms == NULL) { map->size_syms = 0; @@ -191,8 +192,9 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) map->size_syms = sz; } if (newMap->nSyms > 0) { - _XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset], - newMap->nSyms); + if (_XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset], + newMap->nSyms) == 0) + return BadLength; offset += newMap->nSyms; } else { @@ -222,8 +224,10 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) newSyms = XkbResizeKeySyms(xkb, i + rep->firstKeySym, tmp); if (newSyms == NULL) return BadAlloc; - if (newMap->nSyms > 0) - _XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms); + if (newMap->nSyms > 0) { + if (_XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms) == 0) + return BadLength; + } else newSyms[0] = NoSymbol; oldMap->kt_index[0] = newMap->ktIndex[0]; |