| From ba336b24052122b136486961c82deac76bbde455 Mon Sep 17 00:00:00 2001 |
| From: Michal Srb <msrb@suse.com> |
| Date: Wed, 24 May 2017 15:54:42 +0300 |
| Subject: [PATCH] Xi: Do not try to swap GenericEvent. |
| |
| The SProcXSendExtensionEvent must not attempt to swap GenericEvent because |
| it is assuming that the event has fixed size and gives the swapping function |
| xEvent-sized buffer. |
| |
| A GenericEvent would be later rejected by ProcXSendExtensionEvent anyway. |
| |
| Signed-off-by: Michal Srb <msrb@suse.com> |
| Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> |
| Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> |
| |
| CVE: CVE-2017-10971 |
| |
| Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455] |
| |
| Signed-off-by: Jackie Huang <jackie.huang@windriver.com> |
| --- |
| Xi/sendexev.c | 10 +++++++++- |
| 1 file changed, 9 insertions(+), 1 deletion(-) |
| |
| diff --git a/Xi/sendexev.c b/Xi/sendexev.c |
| index 5e63bfc..5c2e0fc 100644 |
| --- a/Xi/sendexev.c |
| +++ b/Xi/sendexev.c |
| @@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client) |
| |
| eventP = (xEvent *) &stuff[1]; |
| for (i = 0; i < stuff->num_events; i++, eventP++) { |
| + if (eventP->u.u.type == GenericEvent) { |
| + client->errorValue = eventP->u.u.type; |
| + return BadValue; |
| + } |
| + |
| proc = EventSwapVector[eventP->u.u.type & 0177]; |
| - if (proc == NotImplemented) /* no swapping proc; invalid event type? */ |
| + /* no swapping proc; invalid event type? */ |
| + if (proc == NotImplemented) { |
| + client->errorValue = eventP->u.u.type; |
| return BadValue; |
| + } |
| (*proc) (eventP, &eventT); |
| *eventP = eventT; |
| } |
| -- |
| 1.7.9.5 |
| |