frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xi: fix length checking with bigreq 

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1639>
This commit is contained in:
Enrico Weigelt, metux IT consult 2024-08-06 11:39:09 +02:00 committed by Marge Bot
parent e1e8ab3ddf
commit fc9f8f8d3c
15 changed files with 19 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Xi/chgdctl.c
View File

@ -116,7 +116,7 @@ ProcXChangeDeviceControl(ClientPtr client)
REQUEST(xChangeDeviceControlReq); REQUEST(xChangeDeviceControlReq);
REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl)); REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl));
len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceControlReq)); len = client->req_len - bytes_to_int32(sizeof(xChangeDeviceControlReq));
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess); ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
if (ret != Success) if (ret != Success)
goto out; goto out;

2
Xi/chgfctl.c
View File

@ -436,7 +436,7 @@ ProcXChangeFeedbackControl(ClientPtr client)
REQUEST(xChangeFeedbackControlReq); REQUEST(xChangeFeedbackControlReq);
REQUEST_AT_LEAST_SIZE(xChangeFeedbackControlReq); REQUEST_AT_LEAST_SIZE(xChangeFeedbackControlReq);
len = stuff->length - bytes_to_int32(sizeof(xChangeFeedbackControlReq)); len = client->req_len - bytes_to_int32(sizeof(xChangeFeedbackControlReq));
rc = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess); rc = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
if (rc != Success) if (rc != Success)
return rc; return rc;

2
Xi/chgkmap.c
View File

@ -106,7 +106,7 @@ ProcXChangeDeviceKeyMapping(ClientPtr client)
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess); ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
if (ret != Success) if (ret != Success)
return ret; return ret;
len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceKeyMappingReq)); len = client->req_len - bytes_to_int32(sizeof(xChangeDeviceKeyMappingReq));
ret = ChangeKeyMapping(client, dev, len, DeviceMappingNotify, ret = ChangeKeyMapping(client, dev, len, DeviceMappingNotify,
stuff->firstKeyCode, stuff->keyCodes, stuff->firstKeyCode, stuff->keyCodes,

2
Xi/chgprop.c
View File

@ -102,7 +102,7 @@ ProcXChangeDeviceDontPropagateList(ClientPtr client)
REQUEST(xChangeDeviceDontPropagateListReq); REQUEST(xChangeDeviceDontPropagateListReq);
REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq); REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xChangeDeviceDontPropagateListReq)) + bytes_to_int32(sizeof(xChangeDeviceDontPropagateListReq)) +
stuff->count) stuff->count)
return BadLength; return BadLength;

2
Xi/getvers.c
View File

@ -92,7 +92,7 @@ ProcXGetExtensionVersion(ClientPtr client)
REQUEST(xGetExtensionVersionReq); REQUEST(xGetExtensionVersionReq);
REQUEST_AT_LEAST_SIZE(xGetExtensionVersionReq); REQUEST_AT_LEAST_SIZE(xGetExtensionVersionReq);
if (stuff->length != bytes_to_int32(sizeof(xGetExtensionVersionReq) + if (client->req_len != bytes_to_int32(sizeof(xGetExtensionVersionReq) +
stuff->nbytes)) stuff->nbytes))
return BadLength; return BadLength;

4
Xi/grabdev.c
View File

@ -82,7 +82,7 @@ SProcXGrabDevice(ClientPtr client)
swapl(&stuff->time); swapl(&stuff->time);
swaps(&stuff->event_count); swaps(&stuff->event_count);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xGrabDeviceReq)) + stuff->event_count) bytes_to_int32(sizeof(xGrabDeviceReq)) + stuff->event_count)
return BadLength; return BadLength;
@ -109,7 +109,7 @@ ProcXGrabDevice(ClientPtr client)
REQUEST(xGrabDeviceReq); REQUEST(xGrabDeviceReq);
REQUEST_AT_LEAST_SIZE(xGrabDeviceReq); REQUEST_AT_LEAST_SIZE(xGrabDeviceReq);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xGrabDeviceReq)) + stuff->event_count) bytes_to_int32(sizeof(xGrabDeviceReq)) + stuff->event_count)
return BadLength; return BadLength;

2
Xi/grabdevb.c
View File

@ -106,7 +106,7 @@ ProcXGrabDeviceButton(ClientPtr client)
REQUEST(xGrabDeviceButtonReq); REQUEST(xGrabDeviceButtonReq);
REQUEST_AT_LEAST_SIZE(xGrabDeviceButtonReq); REQUEST_AT_LEAST_SIZE(xGrabDeviceButtonReq);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xGrabDeviceButtonReq)) + stuff->event_count) bytes_to_int32(sizeof(xGrabDeviceButtonReq)) + stuff->event_count)
return BadLength; return BadLength;

2
Xi/grabdevk.c
View File

@ -104,7 +104,7 @@ ProcXGrabDeviceKey(ClientPtr client)
REQUEST(xGrabDeviceKeyReq); REQUEST(xGrabDeviceKeyReq);
REQUEST_AT_LEAST_SIZE(xGrabDeviceKeyReq); REQUEST_AT_LEAST_SIZE(xGrabDeviceKeyReq);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xGrabDeviceKeyReq)) + stuff->event_count) bytes_to_int32(sizeof(xGrabDeviceKeyReq)) + stuff->event_count)
return BadLength; return BadLength;

2
Xi/selectev.c
View File

@ -148,7 +148,7 @@ ProcXSelectExtensionEvent(ClientPtr client)
REQUEST(xSelectExtensionEventReq); REQUEST(xSelectExtensionEventReq);
REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq); REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xSelectExtensionEventReq)) + stuff->count) bytes_to_int32(sizeof(xSelectExtensionEventReq)) + stuff->count)
return BadLength; return BadLength;

4
Xi/sendexev.c
View File

@ -87,7 +87,7 @@ SProcXSendExtensionEvent(ClientPtr client)
swapl(&stuff->destination); swapl(&stuff->destination);
swaps(&stuff->count); swaps(&stuff->count);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xSendExtensionEventReq)) + stuff->count + bytes_to_int32(sizeof(xSendExtensionEventReq)) + stuff->count +
bytes_to_int32(stuff->num_events * sizeof(xEvent))) bytes_to_int32(stuff->num_events * sizeof(xEvent)))
return BadLength; return BadLength;
@ -133,7 +133,7 @@ ProcXSendExtensionEvent(ClientPtr client)
REQUEST(xSendExtensionEventReq); REQUEST(xSendExtensionEventReq);
REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xSendExtensionEventReq)) + stuff->count + bytes_to_int32(sizeof(xSendExtensionEventReq)) + stuff->count +
(stuff->num_events * bytes_to_int32(sizeof(xEvent)))) (stuff->num_events * bytes_to_int32(sizeof(xEvent))))
return BadLength; return BadLength;

2
Xi/setbmap.c
View File

@ -92,7 +92,7 @@ ProcXSetDeviceButtonMapping(ClientPtr client)
REQUEST(xSetDeviceButtonMappingReq); REQUEST(xSetDeviceButtonMappingReq);
REQUEST_AT_LEAST_SIZE(xSetDeviceButtonMappingReq); REQUEST_AT_LEAST_SIZE(xSetDeviceButtonMappingReq);
if (stuff->length != if (client->req_len !=
bytes_to_int32(sizeof(xSetDeviceButtonMappingReq) + stuff->map_length)) bytes_to_int32(sizeof(xSetDeviceButtonMappingReq) + stuff->map_length))
return BadLength; return BadLength;

2
Xi/setdval.c
View File

@ -100,7 +100,7 @@ ProcXSetDeviceValuators(ClientPtr client)
.status = Success .status = Success
}; };
if (stuff->length != bytes_to_int32(sizeof(xSetDeviceValuatorsReq)) + if (client->req_len != bytes_to_int32(sizeof(xSetDeviceValuatorsReq)) +
stuff->num_valuators) stuff->num_valuators)
return BadLength; return BadLength;

2
Xi/setmmap.c
View File

@ -94,7 +94,7 @@ ProcXSetDeviceModifierMapping(ClientPtr client)
REQUEST(xSetDeviceModifierMappingReq); REQUEST(xSetDeviceModifierMappingReq);
REQUEST_AT_LEAST_SIZE(xSetDeviceModifierMappingReq); REQUEST_AT_LEAST_SIZE(xSetDeviceModifierMappingReq);
if (stuff->length != bytes_to_int32(sizeof(xSetDeviceModifierMappingReq)) + if (client->req_len != bytes_to_int32(sizeof(xSetDeviceModifierMappingReq)) +
(stuff->numKeyPerModifier << 1)) (stuff->numKeyPerModifier << 1))
return BadLength; return BadLength;

2
Xi/xiallowev.c
View File

@ -54,7 +54,7 @@ SProcXIAllowEvents(ClientPtr client)
swaps(&stuff->length); swaps(&stuff->length);
swaps(&stuff->deviceid); swaps(&stuff->deviceid);
swapl(&stuff->time); swapl(&stuff->time);
if (stuff->length > 3) { if (client->req_len > 3) {
xXI2_2AllowEventsReq *req_xi22 = (xXI2_2AllowEventsReq *) stuff; xXI2_2AllowEventsReq *req_xi22 = (xXI2_2AllowEventsReq *) stuff;
REQUEST_AT_LEAST_SIZE(xXI2_2AllowEventsReq); REQUEST_AT_LEAST_SIZE(xXI2_2AllowEventsReq);

6
Xi/xiselectev.c
View File

@ -125,7 +125,7 @@ SProcXISelectEvents(ClientPtr client)
swapl(&stuff->win); swapl(&stuff->win);
swaps(&stuff->num_masks); swaps(&stuff->num_masks);
len = stuff->length - bytes_to_int32(sizeof(xXISelectEventsReq)); len = client->req_len - bytes_to_int32(sizeof(xXISelectEventsReq));
evmask = (xXIEventMask *) &stuff[1]; evmask = (xXIEventMask *) &stuff[1];
for (i = 0; i < stuff->num_masks; i++) { for (i = 0; i < stuff->num_masks; i++) {
if (len < bytes_to_int32(sizeof(xXIEventMask))) if (len < bytes_to_int32(sizeof(xXIEventMask)))
@ -172,7 +172,7 @@ ProcXISelectEvents(ClientPtr client)
while (num_masks--) { while (num_masks--) {
len += sizeof(xXIEventMask) + evmask->mask_len * 4; len += sizeof(xXIEventMask) + evmask->mask_len * 4;
if (bytes_to_int32(len) > stuff->length) if (bytes_to_int32(len) > client->req_len)
return BadLength; return BadLength;
if (evmask->deviceid != XIAllDevices && if (evmask->deviceid != XIAllDevices &&
@ -298,7 +298,7 @@ ProcXISelectEvents(ClientPtr client)
evmask++; evmask++;
} }
if (bytes_to_int32(len) != stuff->length) if (bytes_to_int32(len) != client->req_len)
return BadLength; return BadLength;
/* Set masks on window */ /* Set masks on window */