From 59c977bff66de77bd93ce8853e33e1b4ca661a49 Mon Sep 17 00:00:00 2001 From: Povilas Kanapickas Date: Tue, 14 Dec 2021 15:00:03 +0200 Subject: [PATCH xserver 4/4] render: Fix out of bounds access in SProcRenderCompositeGlyphs() ZDI-CAN-14192, CVE-2021-4008 This vulnerability was discovered and the fix was suggested by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative Signed-off-by: Povilas Kanapickas (cherry picked from commit ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60) --- render/render.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/render/render.c b/render/render.c index c376090ca..456f156d4 100644 --- a/render/render.c +++ b/render/render.c @@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client) i = elt->len; if (i == 0xff) { + if (buffer + 4 > end) { + return BadLength; + } swapl((int *) buffer); buffer += 4; } @@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client) buffer += i; break; case 2: + if (buffer + i * 2 > end) { + return BadLength; + } while (i--) { swaps((short *) buffer); buffer += 2; } break; case 4: + if (buffer + i * 4 > end) { + return BadLength; + } while (i--) { swapl((int *) buffer); buffer += 4; -- 2.33.1