frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xkb: Drop check for XkbSetMapResizeTypes 

Commit 446ff2d317 added checks to
prevalidate the size of incoming SetMap requests.

That commit checks for the XkbSetMapResizeTypes flag to be set before
allowing key types data to be processed.

key types data can be changed or even just sent wholesale unchanged
without the number of key types changing, however. The check for
XkbSetMapResizeTypes rejects those legitimate requests. In particular,
XkbChangeMap never sets XkbSetMapResizeTypes and so always fails now
any time XkbKeyTypesMask is in the changed mask.

This commit drops the check for XkbSetMapResizeTypes in flags when
prevalidating the request length.
This commit is contained in:
Ray Strode 2021-10-04 14:27:54 -04:00 committed by Ray Strode
parent 5daf42b489
commit 8b7f4d3259
1 changed files with 12 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
xkb/xkb.c
View File

@ -2405,21 +2405,19 @@ _XkbSetMapCheckLength(xkbSetMapReq *req)
keytype = (xkbKeyTypeWireDesc *)(req + 1);
for (i = 0; i < req->nTypes; i++) {
_add_check_len(XkbPaddedSize(sz_xkbKeyTypeWireDesc));
if (req->flags & XkbSetMapResizeTypes) {
_add_check_len(keytype->nMapEntries
* sz_xkbKTSetMapEntryWireDesc);
preserve = keytype->preserve;
map_count = keytype->nMapEntries;
if (preserve) {
_add_check_len(map_count * sz_xkbModsWireDesc);
}
keytype += 1;
keytype = (xkbKeyTypeWireDesc *)
((xkbKTSetMapEntryWireDesc *)keytype + map_count);
if (preserve)
keytype = (xkbKeyTypeWireDesc *)
((xkbModsWireDesc *)keytype + map_count);
_add_check_len(keytype->nMapEntries
* sz_xkbKTSetMapEntryWireDesc);
preserve = keytype->preserve;
map_count = keytype->nMapEntries;
if (preserve) {
_add_check_len(map_count * sz_xkbModsWireDesc);
}
keytype += 1;
keytype = (xkbKeyTypeWireDesc *)
((xkbKTSetMapEntryWireDesc *)keytype + map_count);
if (preserve)
keytype = (xkbKeyTypeWireDesc *)
((xkbModsWireDesc *)keytype + map_count);
}
}
/* syms */