diff options
Diffstat (limited to 'meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch')
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch | 70 |
1 files changed, 0 insertions, 70 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch deleted file mode 100644 index 2103e9c198..0000000000 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch +++ /dev/null | |||
@@ -1,70 +0,0 @@ | |||
1 | From 2902b78535ecc6821cc027351818b28a5c7fdbdc Mon Sep 17 00:00:00 2001 | ||
2 | From: Matthieu Herrb <matthieu@herrb.eu> | ||
3 | Date: Tue, 18 Aug 2020 14:55:01 +0200 | ||
4 | Subject: [PATCH] Fix XRecordRegisterClients() Integer underflow | ||
5 | |||
6 | CVE-2020-14362 ZDI-CAN-11574 | ||
7 | |||
8 | This vulnerability was discovered by: | ||
9 | Jan-Niklas Sohn working with Trend Micro Zero Day Initiative | ||
10 | |||
11 | Signed-off-by: Matthieu Herrb <matthieu@herrb.eu> | ||
12 | |||
13 | Upstream-Status: Backport | ||
14 | [https://gitlab.freedesktop.org/xorg/xserver/-/commit/2902b78535ecc6821cc027351818b28a5c7fdbdc] | ||
15 | CVE: CVE-2020-14362 | ||
16 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> | ||
17 | --- | ||
18 | record/record.c | 10 +++++----- | ||
19 | 1 file changed, 5 insertions(+), 5 deletions(-) | ||
20 | |||
21 | diff --git a/record/record.c b/record/record.c | ||
22 | index f2d38c877..be154525d 100644 | ||
23 | --- a/record/record.c | ||
24 | +++ b/record/record.c | ||
25 | @@ -2500,7 +2500,7 @@ SProcRecordQueryVersion(ClientPtr client) | ||
26 | } /* SProcRecordQueryVersion */ | ||
27 | |||
28 | static int _X_COLD | ||
29 | -SwapCreateRegister(xRecordRegisterClientsReq * stuff) | ||
30 | +SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff) | ||
31 | { | ||
32 | int i; | ||
33 | XID *pClientID; | ||
34 | @@ -2510,13 +2510,13 @@ SwapCreateRegister(xRecordRegisterClientsReq * stuff) | ||
35 | swapl(&stuff->nRanges); | ||
36 | pClientID = (XID *) &stuff[1]; | ||
37 | if (stuff->nClients > | ||
38 | - stuff->length - bytes_to_int32(sz_xRecordRegisterClientsReq)) | ||
39 | + client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)) | ||
40 | return BadLength; | ||
41 | for (i = 0; i < stuff->nClients; i++, pClientID++) { | ||
42 | swapl(pClientID); | ||
43 | } | ||
44 | if (stuff->nRanges > | ||
45 | - stuff->length - bytes_to_int32(sz_xRecordRegisterClientsReq) | ||
46 | + client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq) | ||
47 | - stuff->nClients) | ||
48 | return BadLength; | ||
49 | RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges); | ||
50 | @@ -2531,7 +2531,7 @@ SProcRecordCreateContext(ClientPtr client) | ||
51 | |||
52 | swaps(&stuff->length); | ||
53 | REQUEST_AT_LEAST_SIZE(xRecordCreateContextReq); | ||
54 | - if ((status = SwapCreateRegister((void *) stuff)) != Success) | ||
55 | + if ((status = SwapCreateRegister(client, (void *) stuff)) != Success) | ||
56 | return status; | ||
57 | return ProcRecordCreateContext(client); | ||
58 | } /* SProcRecordCreateContext */ | ||
59 | @@ -2544,7 +2544,7 @@ SProcRecordRegisterClients(ClientPtr client) | ||
60 | |||
61 | swaps(&stuff->length); | ||
62 | REQUEST_AT_LEAST_SIZE(xRecordRegisterClientsReq); | ||
63 | - if ((status = SwapCreateRegister((void *) stuff)) != Success) | ||
64 | + if ((status = SwapCreateRegister(client, (void *) stuff)) != Success) | ||
65 | return status; | ||
66 | return ProcRecordRegisterClients(client); | ||
67 | } /* SProcRecordRegisterClients */ | ||
68 | -- | ||
69 | 2.17.1 | ||
70 | |||