frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix XChangeFeedbackControl() request underflow 

CVE-2021-3472 / ZDI-CAN-1259

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
This commit is contained in:
Matthieu Herrb 2021-03-21 18:38:57 +01:00 committed by Matthieu Herrb
parent 66ce61983d
commit 7aaf54a188
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
Xi/chgfctl.c
View File

@ -464,8 +464,11 @@ ProcXChangeFeedbackControl(ClientPtr client)
break; break;
case StringFeedbackClass: case StringFeedbackClass:
{ {
xStringFeedbackCtl *f = ((xStringFeedbackCtl *) &stuff[1]); xStringFeedbackCtl *f;
REQUEST_AT_LEAST_EXTRA_SIZE(xChangeFeedbackControlReq,
sizeof(xStringFeedbackCtl));
f = ((xStringFeedbackCtl *) &stuff[1]);
if (client->swapped) { if (client->swapped) {
if (len < bytes_to_int32(sizeof(xStringFeedbackCtl))) if (len < bytes_to_int32(sizeof(xStringFeedbackCtl)))
return BadLength; return BadLength;