diff options
Diffstat (limited to 'meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-2.patch')
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-2.patch | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-2.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-2.patch new file mode 100644 index 0000000000..5c9887afa1 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-2.patch | |||
@@ -0,0 +1,55 @@ | |||
1 | From 8caed4df36b1f802b4992edcfd282cbeeec35d9d Mon Sep 17 00:00:00 2001 | ||
2 | From: Michal Srb <msrb@suse.com> | ||
3 | Date: Wed, 24 May 2017 15:54:41 +0300 | ||
4 | Subject: [PATCH] Xi: Verify all events in ProcXSendExtensionEvent. | ||
5 | |||
6 | The requirement is that events have type in range | ||
7 | EXTENSION_EVENT_BASE..lastEvent, but it was tested | ||
8 | only for first event of all. | ||
9 | |||
10 | Signed-off-by: Michal Srb <msrb@suse.com> | ||
11 | Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> | ||
12 | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> | ||
13 | |||
14 | CVE: CVE-2017-10971 | ||
15 | |||
16 | Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d] | ||
17 | |||
18 | Signed-off-by: Jackie Huang <jackie.huang@windriver.com> | ||
19 | --- | ||
20 | Xi/sendexev.c | 12 +++++++----- | ||
21 | 1 file changed, 7 insertions(+), 5 deletions(-) | ||
22 | |||
23 | diff --git a/Xi/sendexev.c b/Xi/sendexev.c | ||
24 | index 1cf118a..5e63bfc 100644 | ||
25 | --- a/Xi/sendexev.c | ||
26 | +++ b/Xi/sendexev.c | ||
27 | @@ -117,7 +117,7 @@ SProcXSendExtensionEvent(ClientPtr client) | ||
28 | int | ||
29 | ProcXSendExtensionEvent(ClientPtr client) | ||
30 | { | ||
31 | - int ret; | ||
32 | + int ret, i; | ||
33 | DeviceIntPtr dev; | ||
34 | xEvent *first; | ||
35 | XEventClass *list; | ||
36 | @@ -141,10 +141,12 @@ ProcXSendExtensionEvent(ClientPtr client) | ||
37 | /* The client's event type must be one defined by an extension. */ | ||
38 | |||
39 | first = ((xEvent *) &stuff[1]); | ||
40 | - if (!((EXTENSION_EVENT_BASE <= first->u.u.type) && | ||
41 | - (first->u.u.type < lastEvent))) { | ||
42 | - client->errorValue = first->u.u.type; | ||
43 | - return BadValue; | ||
44 | + for (i = 0; i < stuff->num_events; i++) { | ||
45 | + if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) && | ||
46 | + (first[i].u.u.type < lastEvent))) { | ||
47 | + client->errorValue = first[i].u.u.type; | ||
48 | + return BadValue; | ||
49 | + } | ||
50 | } | ||
51 | |||
52 | list = (XEventClass *) (first + stuff->num_events); | ||
53 | -- | ||
54 | 1.7.9.5 | ||
55 | |||