diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2024-03-22 18:51:45 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2024-04-02 19:19:40 -0700 |
| commit | 96798fc1967491c80a4d0c8d9e0a80586cb2152b (patch) | |
| tree | deca8c80349cf474e052d69ca47b00666178e554 /Xi | |
| parent | 272e2915fedf9c0262e0ee14ad6f513b2439c37a (diff) | |
Xi: ProcXIGetSelectedEvents needs to use unswapped length to send reply
CVE-2024-31080
Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
Diffstat (limited to 'Xi')
| -rw-r--r-- | Xi/xiselectev.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c index edcb8a0d3..ac1494987 100644 --- a/Xi/xiselectev.c +++ b/Xi/xiselectev.c @@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client) InputClientsPtr others = NULL; xXIEventMask *evmask = NULL; DeviceIntPtr dev; + uint32_t length; REQUEST(xXIGetSelectedEventsReq); REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq); @@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client) } } + /* save the value before SRepXIGetSelectedEvents swaps it */ + length = reply.length; WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply); if (reply.num_masks) - WriteToClient(client, reply.length * 4, buffer); + WriteToClient(client, length * 4, buffer); free(buffer); return Success; |