frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfree86: Check for RandR provider functions 

Changing XRandR provider properties if the driver has set no provider
function such as the modesetting driver will cause a NULL pointer
dereference and a crash of the Xorg server.

Related to CVE-2025-49180

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
This commit is contained in:
Olivier Fourdan 2025-04-28 14:59:46 +02:00 committed by Enrico Weigelt
parent 948630fa42
commit 923837e2c9
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/xfree86/modes/xf86RandR12.c
View File

@ -2152,7 +2152,8 @@ xf86RandR14ProviderSetProperty(ScreenPtr pScreen,
/* If we don't have any property handler, then we don't care what the /* If we don't have any property handler, then we don't care what the
* user is setting properties to. * user is setting properties to.
*/ */
if (config->provider_funcs->set_property == NULL) if (config->provider_funcs == NULL ||
config->provider_funcs->set_property == NULL)
return TRUE; return TRUE;
/* /*
@ -2170,7 +2171,8 @@ xf86RandR14ProviderGetProperty(ScreenPtr pScreen,
ScrnInfoPtr pScrn = xf86ScreenToScrn(pScreen); ScrnInfoPtr pScrn = xf86ScreenToScrn(pScreen);
xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(pScrn); xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(pScrn);
if (config->provider_funcs->get_property == NULL) if (config->provider_funcs == NULL ||
config->provider_funcs->get_property == NULL)
return TRUE; return TRUE;
/* Should be safe even w/o vtSema */ /* Should be safe even w/o vtSema */