SecBSD/xenocara
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Need to use unswapped length to send reply in ProcXIGetSelectedEvents() (CVE-2024-31080) and ProcXiPassiveGrabDevice() (CVE-2024-31081)

Browse source
This commit is contained in:
purplerain 2024-04-04 10:21:45 +00:00
parent 5cf6ab0cf4
commit f29b6fb075
Signed by: purplerain
GPG key ID: F42C07F07E2E35B7
2 changed files with 26 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
xserver/Xi/xipassivegrab.c
View file

@ -247,9 +247,18 @@ ProcXIPassiveGrabDevice(ClientPtr client)
} }
} }
WriteReplyToClient(client, sizeof(rep), &rep); if (client->swapped) {
if (rep.num_modifiers) /* save the value before SRepXIPassiveGrabDevice swaps it */
WriteToClient(client, rep.length * 4, modifiers_failed); uint32_t length = rep.length;
WriteReplyToClient(client, sizeof(rep), &rep);
if (length)
WriteToClient(client, length * 4, modifiers_failed);
}
else {
WriteReplyToClient(client, sizeof(rep), &rep);
if (rep.num_modifiers)
WriteToClient(client, rep.length * 4, modifiers_failed);
}
out: out:
free(modifiers_failed); free(modifiers_failed);

17
xserver/Xi/xiselectev.c
View file

@ -418,10 +418,21 @@ ProcXIGetSelectedEvents(ClientPtr client)
} }
} }
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply); if (client->swapped) {
/* save the value before SRepXIGetSelectedEvents swaps it */
uint32_t length = reply.length;
if (reply.num_masks) WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
WriteToClient(client, reply.length * 4, buffer);
if (length)
WriteToClient(client, length * 4, buffer);
}
else {
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
if (reply.num_masks)
WriteToClient(client, reply.length * 4, buffer);
}
free(buffer); free(buffer);
return Success; return Success;