2 files changed, 112 insertions, 0 deletions

diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch
new file mode 100644
index 0000000000..c724cf8fdd
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch
@@ -0,0 +1,111 @@
+From 304a654a0d57bf0f00d8998185f0360332cfa36c Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 10 Jun 2023 16:30:07 -0700
+Subject: [PATCH] InitExt.c: Add bounds checks for extension request, event, &
+ error codes
+
+Fixes CVE-2023-3138: X servers could return values from XQueryExtension
+that would cause Xlib to write entries out-of-bounds of the arrays to
+store them, though this would only overwrite other parts of the Display
+struct, not outside the bounds allocated for that structure.
+
+Reported-by: Gregory James DUCK <gjduck@gmail.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+CVE: CVE-2023-3138
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c.patch]
+Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com>
+---
+ src/InitExt.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 42 insertions(+)
+
+diff --git a/src/InitExt.c b/src/InitExt.c
+index 4de46f15..afc00a6b 100644
+--- a/src/InitExt.c
++++ b/src/InitExt.c
+@@ -33,6 +33,18 @@ from The Open Group.
+ #include <X11/Xos.h>
+ #include <stdio.h>
+ 
++/* The X11 protocol spec reserves events 64 through 127 for extensions */
++#ifndef LastExtensionEvent
++#define LastExtensionEvent 127
++#endif
++
++/* The X11 protocol spec reserves requests 128 through 255 for extensions */
++#ifndef LastExtensionRequest
++#define FirstExtensionRequest 128
++#define LastExtensionRequest 255
++#endif
++
++
+ /*
+  * This routine is used to link a extension in so it will be called
+  * at appropriate times.
+@@ -242,6 +254,12 @@ WireToEventType XESetWireToEvent(
+        WireToEventType proc)   /* routine to call when converting event */
+ {
+        register WireToEventType oldproc;
++       if (event_number < 0 ||
++           event_number > LastExtensionEvent) {
++           fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
++                   event_number);
++           return (WireToEventType)_XUnknownWireEvent;
++       }
+        if (proc == NULL) proc = (WireToEventType)_XUnknownWireEvent;
+        LockDisplay (dpy);
+        oldproc = dpy->event_vec[event_number];
+@@ -263,6 +281,12 @@ WireToEventCookieType XESetWireToEventCookie(
+     )
+ {
+        WireToEventCookieType oldproc;
++       if (extension < FirstExtensionRequest ||
++           extension > LastExtensionRequest) {
++           fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
++                   extension);
++           return (WireToEventCookieType)_XUnknownWireEventCookie;
++       }
+        if (proc == NULL) proc = (WireToEventCookieType)_XUnknownWireEventCookie;
+        LockDisplay (dpy);
+        oldproc = dpy->generic_event_vec[extension & 0x7F];
+@@ -284,6 +308,12 @@ CopyEventCookieType XESetCopyEventCookie(
+     )
+ {
+        CopyEventCookieType oldproc;
++       if (extension < FirstExtensionRequest ||
++           extension > LastExtensionRequest) {
++           fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
++                   extension);
++           return (CopyEventCookieType)_XUnknownCopyEventCookie;
++       }
+        if (proc == NULL) proc = (CopyEventCookieType)_XUnknownCopyEventCookie;
+        LockDisplay (dpy);
+        oldproc = dpy->generic_event_copy_vec[extension & 0x7F];
+@@ -305,6 +335,12 @@ EventToWireType XESetEventToWire(
+        EventToWireType proc)   /* routine to call when converting event */
+ {
+        register EventToWireType oldproc;
++       if (event_number < 0 ||
++           event_number > LastExtensionEvent) {
++           fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
++                   event_number);
++           return (EventToWireType)_XUnknownNativeEvent;
++       }
+        if (proc == NULL) proc = (EventToWireType) _XUnknownNativeEvent;
+        LockDisplay (dpy);
+        oldproc = dpy->wire_vec[event_number];
+@@ -325,6 +361,12 @@ WireToErrorType XESetWireToError(
+        WireToErrorType proc)   /* routine to call when converting error */
+ {
+        register WireToErrorType oldproc = NULL;
++       if (error_number < 0 ||
++           error_number > LastExtensionError) {
++          fprintf(stderr, "Xlib: ignoring invalid extension error %d\n",
++                   error_number);
++          return (WireToErrorType)_XDefaultWireError;
++       }
+        if (proc == NULL) proc = (WireToErrorType)_XDefaultWireError;
+        LockDisplay (dpy);
+        if (!dpy->error_vec) {
+-- 
+GitLab
diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb b/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb
index 3e6b50c0a3..19687d546b 100644
--- a/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb
+++ b/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb
@@ -17,6 +17,7 @@ SRC_URI = "${XORG_MIRROR}/individual/lib/${XORG_PN}-${PV}.tar.xz"
 SRC_URI += "file://disable_tests.patch \
             file://CVE-2022-3554.patch \
             file://CVE-2022-3555.patch \
+            file://CVE-2023-3138.patch \
            "
 SRC_URI[sha256sum] = "2ffd417266fb875028fdc0ef349694f63dbcd76d0b0cfacfb52e6151f4b60989"