33a462d9ba
Resolves: https://issues.redhat.com/browse/RHEL-119967 Resolves: https://issues.redhat.com/browse/RHEL-120015 Resolves: https://issues.redhat.com/browse/RHEL-125007
50 lines
1.8 KiB
Diff
50 lines
1.8 KiB
Diff
From c7beaec76c556870e5566b84dce7099bf28f9502 Mon Sep 17 00:00:00 2001
|
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
Date: Wed, 10 Sep 2025 16:30:29 +0200
|
|
Subject: [PATCH xserver 4/4] xkb: Prevent overflow in XkbSetCompatMap()
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
The XkbCompatMap structure stores its "num_si" and "size_si" fields
|
|
using an unsigned short.
|
|
|
|
However, the function _XkbSetCompatMap() will store the sum of the
|
|
input data "firstSI" and "nSI" in both XkbCompatMap's "num_si" and
|
|
"size_si" without first checking if the sum overflows the maximum
|
|
unsigned short value, leading to a possible overflow.
|
|
|
|
To avoid the issue, check whether the sum does not exceed the maximum
|
|
unsigned short value, or return a "BadValue" error otherwise.
|
|
|
|
CVE-2025-62231, ZDI-CAN-27560
|
|
|
|
This vulnerability was discovered by:
|
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
|
|
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
|
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
|
|
(cherry picked from commit 475d9f49acd0e55bc0b089ed77f732ad18585470)
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2088>
|
|
---
|
|
xkb/xkb.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
|
index 6c102af0a..a77fe7ff0 100644
|
|
--- a/xkb/xkb.c
|
|
+++ b/xkb/xkb.c
|
|
@@ -2990,6 +2990,8 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
|
|
XkbSymInterpretPtr sym;
|
|
unsigned int skipped = 0;
|
|
|
|
+ if ((unsigned) (req->firstSI + req->nSI) > USHRT_MAX)
|
|
+ return BadValue;
|
|
if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
|
|
compat->num_si = compat->size_si = req->firstSI + req->nSI;
|
|
compat->sym_interpret = reallocarray(compat->sym_interpret,
|
|
--
|
|
2.51.1
|
|
|