Attachment 867442 Details for Bug 1212102

[patch] 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch

0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch (text/plain), 3.89 KB, created by Marcus Meissner on 2023-06-08 06:47:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2023-06-08 06:47:36 UTC

Size: 3.89 KB

patch

obsolete

>From 15e532e9ad515f71e816a72ebdaa074a9b8908e1 Mon Sep 17 00:00:00 2001
>From: Alan Coopersmith <alan.coopersmith@oracle.com>
>Date: Sun, 4 Jun 2023 13:10:51 -0700
>Subject: [PATCH libX11] InitExt.c: Add bounds checks for extension request,
> event, & error codes
>
>Fixes CVE-2023-XXXX: X servers could return values from XQueryExtension
>that would cause Xlib to write entries out-of-bounds of the arrays to
>store them, though this would only overwrite other parts of the Display
>struct, not outside the bounds allocated for that structure.
>
>Reported-by: Gregory James DUCK <gjduck@gmail.com>
>Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
>---
> src/InitExt.c | 43 +++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 43 insertions(+)
>
>diff --git a/src/InitExt.c b/src/InitExt.c
>index 4de46f15..007bd27b 100644
>--- a/src/InitExt.c
>+++ b/src/InitExt.c
>@@ -33,6 +33,19 @@ from The Open Group.
> #include <X11/Xos.h>
> #include <stdio.h>
> 
>+/* The X11 protocol spec reserves events 64 through 127 for extensions */
>+#ifndef FirstExtensionEvent
>+#define FirstExtensionEvent 64
>+#define LastExtensionEvent 127
>+#endif
>+
>+/* The X11 protocol spec reserves requests 128 through 255 for extensions */
>+#ifndef FirstExtensionRequest
>+#define FirstExtensionRequest 128
>+#define LastExtensionRequest 255
>+#endif
>+
>+
> /*
>  * This routine is used to link a extension in so it will be called
>  * at appropriate times.
>@@ -242,6 +255,12 @@ WireToEventType XESetWireToEvent(
> 	WireToEventType proc)	/* routine to call when converting event */
> {
> 	register WireToEventType oldproc;
>+	if (event_number < FirstExtensionEvent ||
>+	    event_number > LastExtensionEvent) {
>+	    fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
>+		    event_number);
>+	    return (WireToEventType)_XUnknownWireEvent;
>+	}
> 	if (proc == NULL) proc = (WireToEventType)_XUnknownWireEvent;
> 	LockDisplay (dpy);
> 	oldproc = dpy->event_vec[event_number];
>@@ -263,6 +282,12 @@ WireToEventCookieType XESetWireToEventCookie(
>     )
> {
> 	WireToEventCookieType oldproc;
>+	if (extension < FirstExtensionRequest ||
>+	    extension > LastExtensionRequest) {
>+	    fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
>+		    extension);
>+	    return (WireToEventCookieType)_XUnknownWireEventCookie;
>+	}
> 	if (proc == NULL) proc = (WireToEventCookieType)_XUnknownWireEventCookie;
> 	LockDisplay (dpy);
> 	oldproc = dpy->generic_event_vec[extension & 0x7F];
>@@ -284,6 +309,12 @@ CopyEventCookieType XESetCopyEventCookie(
>     )
> {
> 	CopyEventCookieType oldproc;
>+	if (extension < FirstExtensionRequest ||
>+	    extension > LastExtensionRequest) {
>+	    fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
>+		    extension);
>+	    return (CopyEventCookieType)_XUnknownCopyEventCookie;
>+	}
> 	if (proc == NULL) proc = (CopyEventCookieType)_XUnknownCopyEventCookie;
> 	LockDisplay (dpy);
> 	oldproc = dpy->generic_event_copy_vec[extension & 0x7F];
>@@ -305,6 +336,12 @@ EventToWireType XESetEventToWire(
> 	EventToWireType proc)	/* routine to call when converting event */
> {
> 	register EventToWireType oldproc;
>+	if (event_number < FirstExtensionEvent ||
>+	    event_number > LastExtensionEvent) {
>+	    fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
>+		    event_number);
>+	    return (EventToWireType)_XUnknownNativeEvent;
>+	}
> 	if (proc == NULL) proc = (EventToWireType) _XUnknownNativeEvent;
> 	LockDisplay (dpy);
> 	oldproc = dpy->wire_vec[event_number];
>@@ -325,6 +362,12 @@ WireToErrorType XESetWireToError(
> 	WireToErrorType proc)	/* routine to call when converting error */
> {
> 	register WireToErrorType oldproc = NULL;
>+	if (error_number < FirstExtensionError ||
>+	    error_number > LastExtensionError) {
>+	   fprintf(stderr, "Xlib: ignoring invalid extension error %d\n",
>+		    error_number);
>+	   return (WireToErrorType)_XDefaultWireError;
>+	}
> 	if (proc == NULL) proc = (WireToErrorType)_XDefaultWireError;
> 	LockDisplay (dpy);
> 	if (!dpy->error_vec) {
>-- 
>2.15.2
>

Actions: View | Diff

Attachments on bug 1212102: 867442 | 867443 | 867510