From bd16cc8368afc6959bebfb2b15cfdb93bcac6fee Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Fri, 22 Mar 2024 18:51:45 -0700 Subject: [PATCH xserver 2/4] Xi: ProcXIGetSelectedEvents needs to use unswapped length to send reply CVE-2024-31080 Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762 Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.") Signed-off-by: Alan Coopersmith (cherry picked from commit 96798fc1967491c80a4d0c8d9e0a80586cb2152b) Part-of: --- Xi/xiselectev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c index edcb8a0d3..ac1494987 100644 --- a/Xi/xiselectev.c +++ b/Xi/xiselectev.c @@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client) InputClientsPtr others = NULL; xXIEventMask *evmask = NULL; DeviceIntPtr dev; + uint32_t length; REQUEST(xXIGetSelectedEventsReq); REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq); @@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client) } } + /* save the value before SRepXIGetSelectedEvents swaps it */ + length = reply.length; WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply); if (reply.num_masks) - WriteToClient(client, reply.length * 4, buffer); + WriteToClient(client, length * 4, buffer); free(buffer); return Success; -- 2.44.0