• Olivier Fourdan's avatar
    xkb: Don't swap XkbSetGeometry data in the input buffer · 9308c79b
    Olivier Fourdan authored
    The XkbSetGeometry request embeds data which needs to be swapped when the
    server and the client have different endianess.
    
    _XkbSetGeometry() invokes functions that swap these data directly in the
    input buffer.
    
    However, ProcXkbSetGeometry() may call _XkbSetGeometry() more than once
    (if there is more than one keyboard), thus causing on swapped clients the
    same data to be swapped twice in memory, further causing a server crash
    because the strings lengths on the second time are way off bounds.
    
    To allow _XkbSetGeometry() to run reliably more than once with swapped
    clients, do not swap the data in the buffer, use variables instead.
    
    v3: backport to nx-libs 3.6.x as a prereq for
    the CVE-2015-0255 fix (Mike DePaulo)
    Signed-off-by: 's avatarOlivier Fourdan <ofourdan@redhat.com>
    Signed-off-by: 's avatarPeter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 81c90dc8f0aae3b65730409b1b615b5fa7280ebd)
    (cherry picked from commit 29be310c303914090298ddda93a5bd5d00a94945)
    Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org>
    index 2405090..7db0959 100644
    9308c79b
Name
Last commit
Last update
..
Xserver Loading commit data...
nxauth Loading commit data...
Imakefile Loading commit data...