frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xkb: Fix buffer overflow in XkbVModMaskText() 

The code in XkbVModMaskText() allocates a fixed sized buffer on the
stack and copies the virtual mod name.

There's actually two issues in the code that can lead to a buffer
overflow.

First, the bound check mixes pointers and integers using misplaced
parenthesis, defeating the bound check.

But even though, if the check fails, the data is still copied, so the
stack overflow will occur regardless.

Change the logic to skip the copy entirely if the bound check fails.

CVE-2025-26595, ZDI-CAN-25545

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
This commit is contained in:
Olivier Fourdan 2024-11-27 14:41:45 +01:00
parent b0a09ba602
commit 11fcda8753
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
xkb/xkbtext.c
View File

@ -173,14 +173,14 @@ XkbVModMaskText(XkbDescPtr xkb,
len = strlen(tmp) + 1 + (str == buf ? 0 : 1);
if (format == XkbCFile)
len += 4;
if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) {
if (str != buf) {
if (format == XkbCFile)
*str++ = '|';
else
*str++ = '+';
len--;
}
if ((str - buf) + len > VMOD_BUFFER_SIZE)
continue; /* Skip */
if (str != buf) {
if (format == XkbCFile)
*str++ = '|';
else
*str++ = '+';
len--;
}
if (format == XkbCFile)
sprintf(str, "%sMask", tmp);