diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2022-12-05 15:55:54 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2022-12-14 11:30:16 +1000 |
| commit | fc46ca3353151082f1454dfb4d3ed5f32a3dca75 (patch) | |
| tree | d9751af25863d5deeead9e3c9c87240ce76ec5bc | |
| parent | df2560c59a33d82336ce91cd09de3c4dc9897528 (diff) | |
xkb: reset the radio_groups pointer to NULL after freeing it
Unlike other elements of the keymap, this pointer was freed but not
reset. On a subsequent XkbGetKbdByName request, the server may access
already freed memory.
CVE-2022-4283, ZDI-CAN-19530
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit ccdd431cd8f1cabae9d744f0514b6533c438908c)
| -rw-r--r-- | xkb/xkbUtils.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c index 8975ade8d..9bc51fc71 100644 --- a/xkb/xkbUtils.c +++ b/xkb/xkbUtils.c @@ -1327,6 +1327,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst) } else { free(dst->names->radio_groups); + dst->names->radio_groups = NULL; } dst->names->num_rg = src->names->num_rg; |