frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

(!1639) Xi: fix length checking with bigreq 

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult 2024-08-06 11:39:09 +02:00
parent 983a233d9c
commit f3520016b2
15 changed files with 19 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Xi/chgdctl.c
View File

@ -118,7 +118,7 @@ ProcXChangeDeviceControl(ClientPtr client)
REQUEST(xChangeDeviceControlReq);
REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl));
len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceControlReq));
len = client->req_len - bytes_to_int32(sizeof(xChangeDeviceControlReq));
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
if (ret != Success)
goto out;

2
Xi/chgfctl.c
View File

@ -438,7 +438,7 @@ ProcXChangeFeedbackControl(ClientPtr client)
REQUEST(xChangeFeedbackControlReq);
REQUEST_AT_LEAST_SIZE(xChangeFeedbackControlReq);
len = stuff->length - bytes_to_int32(sizeof(xChangeFeedbackControlReq));
len = client->req_len - bytes_to_int32(sizeof(xChangeFeedbackControlReq));
rc = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
if (rc != Success)
return rc;

2
Xi/chgkmap.c
View File

@ -108,7 +108,7 @@ ProcXChangeDeviceKeyMapping(ClientPtr client)
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
if (ret != Success)
return ret;
len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceKeyMappingReq));
len = client->req_len - bytes_to_int32(sizeof(xChangeDeviceKeyMappingReq));
ret = ChangeKeyMapping(client, dev, len, DeviceMappingNotify,
stuff->firstKeyCode, stuff->keyCodes,

2
Xi/chgprop.c
View File

@ -104,7 +104,7 @@ ProcXChangeDeviceDontPropagateList(ClientPtr client)
REQUEST(xChangeDeviceDontPropagateListReq);
REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xChangeDeviceDontPropagateListReq)) +
stuff->count)
return BadLength;

2
Xi/getvers.c
View File

@ -94,7 +94,7 @@ ProcXGetExtensionVersion(ClientPtr client)
REQUEST(xGetExtensionVersionReq);
REQUEST_AT_LEAST_SIZE(xGetExtensionVersionReq);
if (stuff->length != bytes_to_int32(sizeof(xGetExtensionVersionReq) +
if (client->req_len != bytes_to_int32(sizeof(xGetExtensionVersionReq) +
stuff->nbytes))
return BadLength;

4
Xi/grabdev.c
View File

@ -84,7 +84,7 @@ SProcXGrabDevice(ClientPtr client)
swapl(&stuff->time);
swaps(&stuff->event_count);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xGrabDeviceReq)) + stuff->event_count)
return BadLength;
@ -111,7 +111,7 @@ ProcXGrabDevice(ClientPtr client)
REQUEST(xGrabDeviceReq);
REQUEST_AT_LEAST_SIZE(xGrabDeviceReq);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xGrabDeviceReq)) + stuff->event_count)
return BadLength;

2
Xi/grabdevb.c
View File

@ -108,7 +108,7 @@ ProcXGrabDeviceButton(ClientPtr client)
REQUEST(xGrabDeviceButtonReq);
REQUEST_AT_LEAST_SIZE(xGrabDeviceButtonReq);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xGrabDeviceButtonReq)) + stuff->event_count)
return BadLength;

2
Xi/grabdevk.c
View File

@ -106,7 +106,7 @@ ProcXGrabDeviceKey(ClientPtr client)
REQUEST(xGrabDeviceKeyReq);
REQUEST_AT_LEAST_SIZE(xGrabDeviceKeyReq);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xGrabDeviceKeyReq)) + stuff->event_count)
return BadLength;

2
Xi/selectev.c
View File

@ -150,7 +150,7 @@ ProcXSelectExtensionEvent(ClientPtr client)
REQUEST(xSelectExtensionEventReq);
REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xSelectExtensionEventReq)) + stuff->count)
return BadLength;

4
Xi/sendexev.c
View File

@ -89,7 +89,7 @@ SProcXSendExtensionEvent(ClientPtr client)
swapl(&stuff->destination);
swaps(&stuff->count);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xSendExtensionEventReq)) + stuff->count +
bytes_to_int32(stuff->num_events * sizeof(xEvent)))
return BadLength;
@ -135,7 +135,7 @@ ProcXSendExtensionEvent(ClientPtr client)
REQUEST(xSendExtensionEventReq);
REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xSendExtensionEventReq)) + stuff->count +
(stuff->num_events * bytes_to_int32(sizeof(xEvent))))
return BadLength;

2
Xi/setbmap.c
View File

@ -94,7 +94,7 @@ ProcXSetDeviceButtonMapping(ClientPtr client)
REQUEST(xSetDeviceButtonMappingReq);
REQUEST_AT_LEAST_SIZE(xSetDeviceButtonMappingReq);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xSetDeviceButtonMappingReq) + stuff->map_length))
return BadLength;

2
Xi/setdval.c
View File

@ -102,7 +102,7 @@ ProcXSetDeviceValuators(ClientPtr client)
.status = Success
};
if (stuff->length != bytes_to_int32(sizeof(xSetDeviceValuatorsReq)) +
if (client->req_len != bytes_to_int32(sizeof(xSetDeviceValuatorsReq)) +
stuff->num_valuators)
return BadLength;

2
Xi/setmmap.c
View File

@ -96,7 +96,7 @@ ProcXSetDeviceModifierMapping(ClientPtr client)
REQUEST(xSetDeviceModifierMappingReq);
REQUEST_AT_LEAST_SIZE(xSetDeviceModifierMappingReq);
if (stuff->length != bytes_to_int32(sizeof(xSetDeviceModifierMappingReq)) +
if (client->req_len != bytes_to_int32(sizeof(xSetDeviceModifierMappingReq)) +
(stuff->numKeyPerModifier << 1))
return BadLength;

2
Xi/xiallowev.c
View File

@ -56,7 +56,7 @@ SProcXIAllowEvents(ClientPtr client)
swaps(&stuff->length);
swaps(&stuff->deviceid);
swapl(&stuff->time);
if (stuff->length > 3) {
if (client->req_len > 3) {
xXI2_2AllowEventsReq *req_xi22 = (xXI2_2AllowEventsReq *) stuff;
REQUEST_AT_LEAST_SIZE(xXI2_2AllowEventsReq);

6
Xi/xiselectev.c
View File

@ -127,7 +127,7 @@ SProcXISelectEvents(ClientPtr client)
swapl(&stuff->win);
swaps(&stuff->num_masks);
len = stuff->length - bytes_to_int32(sizeof(xXISelectEventsReq));
len = client->req_len - bytes_to_int32(sizeof(xXISelectEventsReq));
evmask = (xXIEventMask *) &stuff[1];
for (i = 0; i < stuff->num_masks; i++) {
if (len < bytes_to_int32(sizeof(xXIEventMask)))
@ -174,7 +174,7 @@ ProcXISelectEvents(ClientPtr client)
while (num_masks--) {
len += sizeof(xXIEventMask) + evmask->mask_len * 4;
if (bytes_to_int32(len) > stuff->length)
if (bytes_to_int32(len) > client->req_len)
return BadLength;
if (evmask->deviceid != XIAllDevices &&
@ -300,7 +300,7 @@ ProcXISelectEvents(ClientPtr client)
evmask++;
}
if (bytes_to_int32(len) != stuff->length)
if (bytes_to_int32(len) != client->req_len)
return BadLength;
/* Set masks on window */