Patrick Williams | 2390b1b | 2022-11-03 13:47:49 -0500 | [diff] [blame^] | 1 | CVE: CVE-2022-3554 |
| 2 | Upstream-Status: Backport |
| 3 | Signed-off-by: Ross Burton <ross.burton@arm.com> |
| 4 | |
| 5 | From 1d11822601fd24a396b354fa616b04ed3df8b4ef Mon Sep 17 00:00:00 2001 |
| 6 | From: "Thomas E. Dickey" <dickey@invisible-island.net> |
| 7 | Date: Tue, 4 Oct 2022 18:26:17 -0400 |
| 8 | Subject: [PATCH] fix a memory leak in XRegisterIMInstantiateCallback |
| 9 | |
| 10 | Analysis: |
| 11 | |
| 12 | _XimRegisterIMInstantiateCallback() opens an XIM and closes it using |
| 13 | the internal function pointers, but the internal close function does |
| 14 | not free the pointer to the XIM (this would be done in XCloseIM()). |
| 15 | |
| 16 | Report/patch: |
| 17 | |
| 18 | Date: Mon, 03 Oct 2022 18:47:32 +0800 |
| 19 | From: Po Lu <luangruo@yahoo.com> |
| 20 | To: xorg-devel@lists.x.org |
| 21 | Subject: Re: Yet another leak in Xlib |
| 22 | |
| 23 | For reference, here's how I'm calling XRegisterIMInstantiateCallback: |
| 24 | |
| 25 | XSetLocaleModifiers (""); |
| 26 | XRegisterIMInstantiateCallback (compositor.display, |
| 27 | XrmGetDatabase (compositor.display), |
| 28 | (char *) compositor.resource_name, |
| 29 | (char *) compositor.app_name, |
| 30 | IMInstantiateCallback, NULL); |
| 31 | |
| 32 | and XMODIFIERS is: |
| 33 | |
| 34 | @im=ibus |
| 35 | |
| 36 | Signed-off-by: Thomas E. Dickey <dickey@invisible-island.net> |
| 37 | --- |
| 38 | modules/im/ximcp/imInsClbk.c | 3 +++ |
| 39 | 1 file changed, 3 insertions(+) |
| 40 | |
| 41 | diff --git a/modules/im/ximcp/imInsClbk.c b/modules/im/ximcp/imInsClbk.c |
| 42 | index 95b379cb..c10e347f 100644 |
| 43 | --- a/modules/im/ximcp/imInsClbk.c |
| 44 | +++ b/modules/im/ximcp/imInsClbk.c |
| 45 | @@ -212,6 +212,9 @@ _XimRegisterIMInstantiateCallback( |
| 46 | if( xim ) { |
| 47 | lock = True; |
| 48 | xim->methods->close( (XIM)xim ); |
| 49 | + /* XIMs must be freed manually after being opened; close just |
| 50 | + does the protocol to deinitialize the IM. */ |
| 51 | + XFree( xim ); |
| 52 | lock = False; |
| 53 | icb->call = True; |
| 54 | callback( display, client_data, NULL ); |
| 55 | -- |
| 56 | 2.34.1 |
| 57 | |