diff options
Diffstat (limited to 'meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch')
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch new file mode 100644 index 0000000000..c7eb03091d --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | Backport patch to fix CVE-2021-4011. | ||
2 | |||
3 | CVE: CVE-2021-4011 | ||
4 | Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/e56f61c] | ||
5 | |||
6 | Signed-off-by: Kai Kang <kai.kang@windriver.com> | ||
7 | |||
8 | From e56f61c79fc3cee26d83cda0f84ae56d5979f768 Mon Sep 17 00:00:00 2001 | ||
9 | From: Povilas Kanapickas <povilas@radix.lt> | ||
10 | Date: Tue, 14 Dec 2021 15:00:00 +0200 | ||
11 | Subject: [PATCH] record: Fix out of bounds access in SwapCreateRegister() | ||
12 | |||
13 | ZDI-CAN-14952, CVE-2021-4011 | ||
14 | |||
15 | This vulnerability was discovered and the fix was suggested by: | ||
16 | Jan-Niklas Sohn working with Trend Micro Zero Day Initiative | ||
17 | |||
18 | Signed-off-by: Povilas Kanapickas <povilas@radix.lt> | ||
19 | --- | ||
20 | record/record.c | 4 ++-- | ||
21 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
22 | |||
23 | diff --git a/record/record.c b/record/record.c | ||
24 | index be154525d..e123867a7 100644 | ||
25 | --- a/record/record.c | ||
26 | +++ b/record/record.c | ||
27 | @@ -2516,8 +2516,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff) | ||
28 | swapl(pClientID); | ||
29 | } | ||
30 | if (stuff->nRanges > | ||
31 | - client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq) | ||
32 | - - stuff->nClients) | ||
33 | + (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq) | ||
34 | + - stuff->nClients) / bytes_to_int32(sz_xRecordRange)) | ||
35 | return BadLength; | ||
36 | RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges); | ||
37 | return Success; | ||
38 | -- | ||
39 | GitLab | ||
40 | |||