From d2dcbdc67c96c84dff301505072b0b7b022f1a14 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Sun, 4 Dec 2022 17:40:21 +0000 Subject: [PATCH 1/3] xkb: proof GetCountedString against request length attacks GetCountedString did a check for the whole string to be within the request buffer but not for the initial 2 bytes that contain the length field. A swapped client could send a malformed request to trigger a swaps() on those bytes, writing into random memory. Signed-off-by: Peter Hutterer Ustream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bffcb72e] CVE: CVE-2022-3550 Signed-off-by:Minjae Kim --- xkb/xkb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/xkb/xkb.c b/xkb/xkb.c index 68c59df..bf8aaa3 100644 --- a/xkb/xkb.c +++ b/xkb/xkb.c @@ -5138,6 +5138,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) CARD16 len; wire = *wire_inout; + + if (client->req_len < + bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) + return BadValue; + len = *(CARD16 *) wire; if (client->swapped) { swaps(&len); -- 2.17.1