diff options
-rw-r--r-- | meta/recipes-graphics/xorg-lib/libx11/0001-fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch | 57 | ||||
-rw-r--r-- | meta/recipes-graphics/xorg-lib/libx11_1.8.1.bb | 1 |
2 files changed, 58 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-lib/libx11/0001-fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch b/meta/recipes-graphics/xorg-lib/libx11/0001-fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch new file mode 100644 index 0000000000..722116c07e --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libx11/0001-fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch | |||
@@ -0,0 +1,57 @@ | |||
1 | CVE: CVE-2022-3554 | ||
2 | Upstream-Status: Backport | ||
3 | Signed-off-by: Ross Burton <ross.burton@arm.com> | ||
4 | |||
5 | From 1d11822601fd24a396b354fa616b04ed3df8b4ef Mon Sep 17 00:00:00 2001 | ||
6 | From: "Thomas E. Dickey" <dickey@invisible-island.net> | ||
7 | Date: Tue, 4 Oct 2022 18:26:17 -0400 | ||
8 | Subject: [PATCH] fix a memory leak in XRegisterIMInstantiateCallback | ||
9 | |||
10 | Analysis: | ||
11 | |||
12 | _XimRegisterIMInstantiateCallback() opens an XIM and closes it using | ||
13 | the internal function pointers, but the internal close function does | ||
14 | not free the pointer to the XIM (this would be done in XCloseIM()). | ||
15 | |||
16 | Report/patch: | ||
17 | |||
18 | Date: Mon, 03 Oct 2022 18:47:32 +0800 | ||
19 | From: Po Lu <luangruo@yahoo.com> | ||
20 | To: xorg-devel@lists.x.org | ||
21 | Subject: Re: Yet another leak in Xlib | ||
22 | |||
23 | For reference, here's how I'm calling XRegisterIMInstantiateCallback: | ||
24 | |||
25 | XSetLocaleModifiers (""); | ||
26 | XRegisterIMInstantiateCallback (compositor.display, | ||
27 | XrmGetDatabase (compositor.display), | ||
28 | (char *) compositor.resource_name, | ||
29 | (char *) compositor.app_name, | ||
30 | IMInstantiateCallback, NULL); | ||
31 | |||
32 | and XMODIFIERS is: | ||
33 | |||
34 | @im=ibus | ||
35 | |||
36 | Signed-off-by: Thomas E. Dickey <dickey@invisible-island.net> | ||
37 | --- | ||
38 | modules/im/ximcp/imInsClbk.c | 3 +++ | ||
39 | 1 file changed, 3 insertions(+) | ||
40 | |||
41 | diff --git a/modules/im/ximcp/imInsClbk.c b/modules/im/ximcp/imInsClbk.c | ||
42 | index 95b379cb..c10e347f 100644 | ||
43 | --- a/modules/im/ximcp/imInsClbk.c | ||
44 | +++ b/modules/im/ximcp/imInsClbk.c | ||
45 | @@ -212,6 +212,9 @@ _XimRegisterIMInstantiateCallback( | ||
46 | if( xim ) { | ||
47 | lock = True; | ||
48 | xim->methods->close( (XIM)xim ); | ||
49 | + /* XIMs must be freed manually after being opened; close just | ||
50 | + does the protocol to deinitialize the IM. */ | ||
51 | + XFree( xim ); | ||
52 | lock = False; | ||
53 | icb->call = True; | ||
54 | callback( display, client_data, NULL ); | ||
55 | -- | ||
56 | 2.34.1 | ||
57 | |||
diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.8.1.bb b/meta/recipes-graphics/xorg-lib/libx11_1.8.1.bb index 1dcc3abee9..9ff196c897 100644 --- a/meta/recipes-graphics/xorg-lib/libx11_1.8.1.bb +++ b/meta/recipes-graphics/xorg-lib/libx11_1.8.1.bb | |||
@@ -15,6 +15,7 @@ PE = "1" | |||
15 | SRC_URI = "${XORG_MIRROR}/individual/lib/${XORG_PN}-${PV}.tar.xz" | 15 | SRC_URI = "${XORG_MIRROR}/individual/lib/${XORG_PN}-${PV}.tar.xz" |
16 | 16 | ||
17 | SRC_URI += "file://disable_tests.patch \ | 17 | SRC_URI += "file://disable_tests.patch \ |
18 | file://0001-fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch \ | ||
18 | " | 19 | " |
19 | SRC_URI[sha256sum] = "1bc41aa1bbe01401f330d76dfa19f386b79c51881c7bbfee9eb4e27f22f2d9f7" | 20 | SRC_URI[sha256sum] = "1bc41aa1bbe01401f330d76dfa19f386b79c51881c7bbfee9eb4e27f22f2d9f7" |
20 | 21 | ||