90 lines
3.2 KiB
Diff
90 lines
3.2 KiB
Diff
From 4c8e10312a721aa2f36048388284a2fd4ad97043 Mon Sep 17 00:00:00 2001
|
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
Date: Fri, 28 Mar 2025 09:43:52 +0100
|
|
Subject: [PATCH xserver 1/7] render: Avoid 0 or less animated cursors
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Animated cursors use a series of cursors that the client can set.
|
|
|
|
By default, the Xserver assumes at least one cursor is specified
|
|
while a client may actually pass no cursor at all.
|
|
|
|
That causes an out-of-bound read creating the animated cursor and a
|
|
crash of the Xserver:
|
|
|
|
| Invalid read of size 8
|
|
| at 0x5323F4: AnimCursorCreate (animcur.c:325)
|
|
| by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
|
|
| by 0x52DC80: ProcRenderDispatch (render.c:1999)
|
|
| by 0x4A1E9D: Dispatch (dispatch.c:560)
|
|
| by 0x4B0169: dix_main (main.c:284)
|
|
| by 0x4287F5: main (stubmain.c:34)
|
|
| Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd
|
|
| at 0x48468D3: reallocarray (vg_replace_malloc.c:1803)
|
|
| by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802)
|
|
| by 0x52DC80: ProcRenderDispatch (render.c:1999)
|
|
| by 0x4A1E9D: Dispatch (dispatch.c:560)
|
|
| by 0x4B0169: dix_main (main.c:284)
|
|
| by 0x4287F5: main (stubmain.c:34)
|
|
|
|
|
| Invalid read of size 2
|
|
| at 0x5323F7: AnimCursorCreate (animcur.c:325)
|
|
| by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
|
|
| by 0x52DC80: ProcRenderDispatch (render.c:1999)
|
|
| by 0x4A1E9D: Dispatch (dispatch.c:560)
|
|
| by 0x4B0169: dix_main (main.c:284)
|
|
| by 0x4287F5: main (stubmain.c:34)
|
|
| Address 0x8 is not stack'd, malloc'd or (recently) free'd
|
|
|
|
To avoid the issue, check the number of cursors specified and return a
|
|
BadValue error in both the proc handler (early) and the animated cursor
|
|
creation (as this is a public function) if there is 0 or less cursor.
|
|
|
|
CVE-2025-49175
|
|
|
|
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
|
|
reported by Julian Suleder via ERNW Vulnerability Disclosure.
|
|
|
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
|
Reviewed-by: José Expósito <jexposit@redhat.com>
|
|
(cherry picked from commit 0885e0b26225c90534642fe911632ec0779eebee)
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2025>
|
|
---
|
|
render/animcur.c | 3 +++
|
|
render/render.c | 2 ++
|
|
2 files changed, 5 insertions(+)
|
|
|
|
diff --git a/render/animcur.c b/render/animcur.c
|
|
index ef27bda27..77942d846 100644
|
|
--- a/render/animcur.c
|
|
+++ b/render/animcur.c
|
|
@@ -304,6 +304,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor,
|
|
int rc = BadAlloc, i;
|
|
AnimCurPtr ac;
|
|
|
|
+ if (ncursor <= 0)
|
|
+ return BadValue;
|
|
+
|
|
for (i = 0; i < screenInfo.numScreens; i++)
|
|
if (!GetAnimCurScreen(screenInfo.screens[i]))
|
|
return BadImplementation;
|
|
diff --git a/render/render.c b/render/render.c
|
|
index 456f156d4..e9bbac62d 100644
|
|
--- a/render/render.c
|
|
+++ b/render/render.c
|
|
@@ -1788,6 +1788,8 @@ ProcRenderCreateAnimCursor(ClientPtr client)
|
|
ncursor =
|
|
(client->req_len -
|
|
(bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1;
|
|
+ if (ncursor <= 0)
|
|
+ return BadValue;
|
|
cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32));
|
|
if (!cursors)
|
|
return BadAlloc;
|
|
--
|
|
2.49.0
|
|
|