frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfixes: Check request length for SetClientDisconnectMode 

The handler of XFixesSetClientDisconnectMode does not check the client
request length.

A client could send a shorter request and read data from a former
request.

Fix the issue by checking the request size matches.

CVE-2025-49177

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Fixes: e167299f6 - xfixes: Add ClientDisconnectMode
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
This commit is contained in:
Olivier Fourdan 2025-04-28 10:05:36 +02:00 committed by Enrico Weigelt
parent 3151e489e4
commit a1e44d3c4f
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
xfixes/disconnect.c
View File

@ -66,6 +66,7 @@ ProcXFixesSetClientDisconnectMode(ClientPtr client)
ClientDisconnectPtr pDisconnect = GetClientDisconnect(client); ClientDisconnectPtr pDisconnect = GetClientDisconnect(client);
REQUEST(xXFixesSetClientDisconnectModeReq); REQUEST(xXFixesSetClientDisconnectModeReq);
REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq);
pDisconnect->disconnect_mode = stuff->disconnect_mode; pDisconnect->disconnect_mode = stuff->disconnect_mode;
@ -76,7 +77,7 @@ int _X_COLD
SProcXFixesSetClientDisconnectMode(ClientPtr client) SProcXFixesSetClientDisconnectMode(ClientPtr client)
{ {
REQUEST(xXFixesSetClientDisconnectModeReq); REQUEST(xXFixesSetClientDisconnectModeReq);
REQUEST_AT_LEAST_SIZE(xXFixesSetClientDisconnectModeReq); REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq);
swapl(&stuff->disconnect_mode); swapl(&stuff->disconnect_mode);