SecBSD/xenocara
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix several input validation errors in libX11 and libXpm. CVE-2023-43785 CVE-2023-43786 CVE-2023-43787 CVE-2023-43788 CVE-2023-43789

Browse source
This commit is contained in:
purplerain 2023-10-04 03:57:45 +00:00
parent 21df3bcb54
commit e1ec829e63
Signed by: purplerain
GPG key ID: F42C07F07E2E35B7
11 changed files with 153 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/libX11/src/CrPixmap.c
View file

@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
#include <config.h>
#endif
#include "Xlibint.h"
#include <limits.h>
#ifdef USE_DYNAMIC_XCURSOR
void
@ -47,6 +48,16 @@ Pixmap XCreatePixmap (
Pixmap pid;
register xCreatePixmapReq *req;
/*
* Force a BadValue X Error if the requested dimensions are larger
* than the X11 protocol has room for, since that's how callers expect
* to get notified of errors.
*/
if (width > USHRT_MAX)
width = 0;
if (height > USHRT_MAX)
height = 0;
LockDisplay(dpy);
GetReq(CreatePixmap, req);
req->drawable = d;

20
lib/libX11/src/ImUtil.c
View file

@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
#include <X11/Xlibint.h>
#include <X11/Xutil.h>
#include <stdio.h>
#include <limits.h>
#include "ImUtil.h"
static int _XDestroyImage(XImage *);
@ -361,13 +362,22 @@ XImage *XCreateImage (
/*
* compute per line accelerator.
*/
{
if (format == ZPixmap)
if (format == ZPixmap) {
if ((INT_MAX / bits_per_pixel) < width) {
Xfree(image);
return NULL;
}
min_bytes_per_line =
ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
else
ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
} else {
if ((INT_MAX - offset) < width) {
Xfree(image);
return NULL;
}
min_bytes_per_line =
ROUNDUP((width + offset), image->bitmap_pad);
ROUNDUP((width + offset), image->bitmap_pad);
}
if (image_bytes_per_line == 0) {
image->bytes_per_line = min_bytes_per_line;

10
lib/libX11/src/PutImage.c
View file

@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
#include "Xlibint.h"
#include "Xutil.h"
#include <stdio.h>
#include <limits.h>
#include "Cr.h"
#include "ImUtil.h"
#include "reallocarray.h"
@ -914,8 +915,9 @@ PutSubImage (
req_width, req_height - SubImageHeight,
dest_bits_per_pixel, dest_scanline_pad);
} else {
int SubImageWidth = (((Available << 3) / dest_scanline_pad)
* dest_scanline_pad) - left_pad;
int SubImageWidth = ((((Available << 3) / dest_scanline_pad)
* dest_scanline_pad) - left_pad)
/ dest_bits_per_pixel;
PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y,
(unsigned int) SubImageWidth, 1,
@ -961,6 +963,10 @@ XPutImage (
height = image->height - req_yoffset;
if ((width <= 0) || (height <= 0))
return 0;
if (width > USHRT_MAX)
width = USHRT_MAX;
if (height > USHRT_MAX)
height = USHRT_MAX;
if ((image->bits_per_pixel == 1) || (image->format != ZPixmap)) {
dest_bits_per_pixel = 1;

14
lib/libX11/src/xkb/XKBGetMap.c
View file

@ -182,7 +182,8 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
if (offset + newMap->nSyms >= map->size_syms) {
register int sz;
sz = map->size_syms + 128;
sz = offset + newMap->nSyms;
sz = ((sz + (unsigned) 128) / 128) * 128;
_XkbResizeArray(map->syms, map->size_syms, sz, KeySym);
if (map->syms == NULL) {
map->size_syms = 0;
@ -191,8 +192,9 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
map->size_syms = sz;
}
if (newMap->nSyms > 0) {
_XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset],
newMap->nSyms);
if (_XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset],
newMap->nSyms) == 0)
return BadLength;
offset += newMap->nSyms;
}
else {
@ -222,8 +224,10 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
newSyms = XkbResizeKeySyms(xkb, i + rep->firstKeySym, tmp);
if (newSyms == NULL)
return BadAlloc;
if (newMap->nSyms > 0)
_XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms);
if (newMap->nSyms > 0) {
if (_XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms) == 0)
return BadLength;
}
else
newSyms[0] = NoSymbol;
oldMap->kt_index[0] = newMap->ktIndex[0];