Module Name: xsrc
Committed By: mrg
Date: Sat Nov 2 23:37:17 UTC 2024
Modified Files:
xsrc/external/mit/xorg-server.old/dist/Xi: exevents.c xiquerypointer.c
Log Message:
merge upstream change 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 though the
enterleave.c portion msut be applied to Xi/exevents.c:DeviceFocusEvent().
Subject: [PATCH] dix: allocate enough space for logical button maps
Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
each logical button currently down. Since buttons can be arbitrarily mapped
to anything up to 255 make sure we have enough bits for the maximum mapping.
CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 xsrc/external/mit/xorg-server.old/dist/Xi/exevents.c
cvs rdiff -u -r1.1.1.1 -r1.2 \
xsrc/external/mit/xorg-server.old/dist/Xi/xiquerypointer.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: xsrc/external/mit/xorg-server.old/dist/Xi/exevents.c
diff -u xsrc/external/mit/xorg-server.old/dist/Xi/exevents.c:1.2 xsrc/external/mit/xorg-server.old/dist/Xi/exevents.c:1.3
--- xsrc/external/mit/xorg-server.old/dist/Xi/exevents.c:1.2 Tue Feb 7 07:29:44 2023
+++ xsrc/external/mit/xorg-server.old/dist/Xi/exevents.c Sat Nov 2 23:37:17 2024
@@ -1224,8 +1224,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int t
mouse = (IsMaster(dev) || dev->u.master) ? GetMaster(dev, MASTER_POINTER) : dev;
- /* XI 2 event */
- btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0;
+ /* XI 2 event contains the logical button map - maps are CARD8
+ * so we need 256 bits for the possibly maximum mapping */
+ btlen = (mouse->button) ? bits_to_bytes(256) : 0;
btlen = bytes_to_int32(btlen);
len = sizeof(xXIFocusInEvent) + btlen * 4;
Index: xsrc/external/mit/xorg-server.old/dist/Xi/xiquerypointer.c
diff -u xsrc/external/mit/xorg-server.old/dist/Xi/xiquerypointer.c:1.1.1.1 xsrc/external/mit/xorg-server.old/dist/Xi/xiquerypointer.c:1.2
--- xsrc/external/mit/xorg-server.old/dist/Xi/xiquerypointer.c:1.1.1.1 Thu Jun 9 09:07:56 2016
+++ xsrc/external/mit/xorg-server.old/dist/Xi/xiquerypointer.c Sat Nov 2 23:37:17 2024
@@ -144,7 +144,7 @@ ProcXIQueryPointer(ClientPtr client)
if (pDev->button)
{
int i, down;
- rep.buttons_len = bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
+ rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */
rep.length += rep.buttons_len;
buttons_size = rep.buttons_len * 4;
buttons = calloc(1, buttons_size);
