frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

composite: Fix use-after-free of the COW 

ZDI-CAN-19866/CVE-2023-1393

If a client explicitly destroys the compositor overlay window (aka COW),
we would leave a dangling pointer to that window in the CompScreen
structure, which will trigger a use-after-free later.

Make sure to clear the CompScreen pointer to the COW when the latter gets
destroyed explicitly by the client.

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
This commit is contained in:
Olivier Fourdan 2023-03-13 11:08:47 +01:00
parent 6153c71cfb
commit 26ef545b35
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
composite/compwindow.c
View File

@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
ret = (*pScreen->DestroyWindow) (pWin); ret = (*pScreen->DestroyWindow) (pWin);
cs->DestroyWindow = pScreen->DestroyWindow; cs->DestroyWindow = pScreen->DestroyWindow;
pScreen->DestroyWindow = compDestroyWindow; pScreen->DestroyWindow = compDestroyWindow;
/* Did we just destroy the overlay window? */
if (pWin == cs->pOverlayWin)
cs->pOverlayWin = NULL;
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/ /* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
return ret; return ret;
} }