Attachment 867510 Details for Bug 1212102

[patch] 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch

0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch (text/plain), 3.80 KB, created by Thomas Leroy on 2023-06-12 12:24:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Leroy

Created: 2023-06-12 12:24:08 UTC

Size: 3.80 KB

patch

obsolete

>From 304a654a0d57bf0f00d8998185f0360332cfa36c Mon Sep 17 00:00:00 2001
>From: Alan Coopersmith <alan.coopersmith@oracle.com>
>Date: Sat, 10 Jun 2023 16:30:07 -0700
>Subject: [PATCH libX11] InitExt.c: Add bounds checks for extension request,
> event, & error codes
>
>Fixes CVE-2023-3138: X servers could return values from XQueryExtension
>that would cause Xlib to write entries out-of-bounds of the arrays to
>store them, though this would only overwrite other parts of the Display
>struct, not outside the bounds allocated for that structure.
>
>Reported-by: Gregory James DUCK <gjduck@gmail.com>
>Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
>---
> src/InitExt.c | 42 ++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 42 insertions(+)
>
>diff --git a/src/InitExt.c b/src/InitExt.c
>index 4de46f15..afc00a6b 100644
>--- a/src/InitExt.c
>+++ b/src/InitExt.c
>@@ -33,6 +33,18 @@ from The Open Group.
> #include <X11/Xos.h>
> #include <stdio.h>
> 
>+/* The X11 protocol spec reserves events 64 through 127 for extensions */
>+#ifndef LastExtensionEvent
>+#define LastExtensionEvent 127
>+#endif
>+
>+/* The X11 protocol spec reserves requests 128 through 255 for extensions */
>+#ifndef LastExtensionRequest
>+#define FirstExtensionRequest 128
>+#define LastExtensionRequest 255
>+#endif
>+
>+
> /*
>  * This routine is used to link a extension in so it will be called
>  * at appropriate times.
>@@ -242,6 +254,12 @@ WireToEventType XESetWireToEvent(
> 	WireToEventType proc)	/* routine to call when converting event */
> {
> 	register WireToEventType oldproc;
>+	if (event_number < 0 ||
>+	    event_number > LastExtensionEvent) {
>+	    fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
>+		    event_number);
>+	    return (WireToEventType)_XUnknownWireEvent;
>+	}
> 	if (proc == NULL) proc = (WireToEventType)_XUnknownWireEvent;
> 	LockDisplay (dpy);
> 	oldproc = dpy->event_vec[event_number];
>@@ -263,6 +281,12 @@ WireToEventCookieType XESetWireToEventCookie(
>     )
> {
> 	WireToEventCookieType oldproc;
>+	if (extension < FirstExtensionRequest ||
>+	    extension > LastExtensionRequest) {
>+	    fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
>+		    extension);
>+	    return (WireToEventCookieType)_XUnknownWireEventCookie;
>+	}
> 	if (proc == NULL) proc = (WireToEventCookieType)_XUnknownWireEventCookie;
> 	LockDisplay (dpy);
> 	oldproc = dpy->generic_event_vec[extension & 0x7F];
>@@ -284,6 +308,12 @@ CopyEventCookieType XESetCopyEventCookie(
>     )
> {
> 	CopyEventCookieType oldproc;
>+	if (extension < FirstExtensionRequest ||
>+	    extension > LastExtensionRequest) {
>+	    fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
>+		    extension);
>+	    return (CopyEventCookieType)_XUnknownCopyEventCookie;
>+	}
> 	if (proc == NULL) proc = (CopyEventCookieType)_XUnknownCopyEventCookie;
> 	LockDisplay (dpy);
> 	oldproc = dpy->generic_event_copy_vec[extension & 0x7F];
>@@ -305,6 +335,12 @@ EventToWireType XESetEventToWire(
> 	EventToWireType proc)	/* routine to call when converting event */
> {
> 	register EventToWireType oldproc;
>+	if (event_number < 0 ||
>+	    event_number > LastExtensionEvent) {
>+	    fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
>+		    event_number);
>+	    return (EventToWireType)_XUnknownNativeEvent;
>+	}
> 	if (proc == NULL) proc = (EventToWireType) _XUnknownNativeEvent;
> 	LockDisplay (dpy);
> 	oldproc = dpy->wire_vec[event_number];
>@@ -325,6 +361,12 @@ WireToErrorType XESetWireToError(
> 	WireToErrorType proc)	/* routine to call when converting error */
> {
> 	register WireToErrorType oldproc = NULL;
>+	if (error_number < 0 ||
>+	    error_number > LastExtensionError) {
>+	   fprintf(stderr, "Xlib: ignoring invalid extension error %d\n",
>+		    error_number);
>+	   return (WireToErrorType)_XDefaultWireError;
>+	}
> 	if (proc == NULL) proc = (WireToErrorType)_XDefaultWireError;
> 	LockDisplay (dpy);
> 	if (!dpy->error_vec) {
>-- 
>2.15.2
>

Actions: View | Diff

Attachments on bug 1212102: 867442 | 867443 | 867510