• Olivier Fourdan's avatar
    xkb: Don't swap XkbSetGeometry data in the input buffer · 9308c79b
    Olivier Fourdan authored
    The XkbSetGeometry request embeds data which needs to be swapped when the
    server and the client have different endianess.
    
    _XkbSetGeometry() invokes functions that swap these data directly in the
    input buffer.
    
    However, ProcXkbSetGeometry() may call _XkbSetGeometry() more than once
    (if there is more than one keyboard), thus causing on swapped clients the
    same data to be swapped twice in memory, further causing a server crash
    because the strings lengths on the second time are way off bounds.
    
    To allow _XkbSetGeometry() to run reliably more than once with swapped
    clients, do not swap the data in the buffer, use variables instead.
    
    v3: backport to nx-libs 3.6.x as a prereq for
    the CVE-2015-0255 fix (Mike DePaulo)
    Signed-off-by: 's avatarOlivier Fourdan <ofourdan@redhat.com>
    Signed-off-by: 's avatarPeter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 81c90dc8f0aae3b65730409b1b615b5fa7280ebd)
    (cherry picked from commit 29be310c303914090298ddda93a5bd5d00a94945)
    Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org>
    index 2405090..7db0959 100644
    9308c79b
Name
Last commit
Last update
..
GL Loading commit data...
XTrap Loading commit data...
Xext Loading commit data...
Xi Loading commit data...
composite Loading commit data...
damageext Loading commit data...
dbe Loading commit data...
dix Loading commit data...
fb Loading commit data...
hw Loading commit data...
include Loading commit data...
mfb Loading commit data...
mi Loading commit data...
miext Loading commit data...
os Loading commit data...
randr Loading commit data...
record Loading commit data...
render Loading commit data...
xfixes Loading commit data...
xkb Loading commit data...
Imakefile Loading commit data...
Xserver.man Loading commit data...