Module Name: xsrc
Committed By: mrg
Date: Sun Nov 3 00:53:37 UTC 2024
Modified Files:
xsrc/external/mit/xorg-server.old/dist/Xi: xiselectev.c
Log Message:
apply upstream change 96798fc1967491c80a4d0c8d9e0a80586cb2152b
Subject: [PATCH] Xi: ProcXIGetSelectedEvents needs to use unswapped length to
send reply
CVE-2024-31080
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.1 -r1.2 \
xsrc/external/mit/xorg-server.old/dist/Xi/xiselectev.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: xsrc/external/mit/xorg-server.old/dist/Xi/xiselectev.c
diff -u xsrc/external/mit/xorg-server.old/dist/Xi/xiselectev.c:1.1.1.1 xsrc/external/mit/xorg-server.old/dist/Xi/xiselectev.c:1.2
--- xsrc/external/mit/xorg-server.old/dist/Xi/xiselectev.c:1.1.1.1 Thu Jun 9 09:07:56 2016
+++ xsrc/external/mit/xorg-server.old/dist/Xi/xiselectev.c Sun Nov 3 00:53:37 2024
@@ -222,6 +222,7 @@ ProcXIGetSelectedEvents(ClientPtr client
InputClientsPtr others = NULL;
xXIEventMask *evmask = NULL;
DeviceIntPtr dev;
+ uint32_t length;
REQUEST(xXIGetSelectedEventsReq);
REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
@@ -295,10 +296,12 @@ ProcXIGetSelectedEvents(ClientPtr client
}
}
+ /* save the value before SRepXIGetSelectedEvents swaps it */
+ length = reply.length;
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
if (reply.num_masks)
- WriteToClient(client, reply.length * 4, buffer);
+ WriteToClient(client, length * 4, buffer);
free(buffer);
return Success;
