frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/dix
History
Olivier Fourdan 3151e489e4 os: Do not overflow the integer size with BigRequest 
The BigRequest extension allows requests larger than the 16-bit length
limit.

It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.

In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.

To avoid the issue, make sure to check that the request size does not
overflow the maxBigRequestSize limit prior to any conversion.

The caller Dispatch() function however expects the return value to be in
bytes, so we cannot just return the converted value in case of error, as
that would also overflow the integer size.

To preserve the existing API, we use a negative value for the X11 error
code BadLength as the function only return positive values, 0 or -1 and
update the caller Dispatch() function to take that case into account to
return the error code to the offending client.

CVE-2025-49176

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
 		2025-06-17 20:01:25 +02:00
..
.gitignore Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
BuiltInAtoms R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
atom.c dix: replace xallocarray() by calloc() 2025-06-12 17:21:43 +02:00
atom_priv.h dix: unexport InitAtoms() and FreeAllAtoms() 2025-06-12 16:20:15 +02:00
callback_priv.h dix: make DeleteCallbackList() non-static and document it 2025-06-12 16:43:56 +02:00
closestr.h fix name clash on 'GC' between Xlib and Xserver 2025-06-12 16:52:25 +02:00
color.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
colormap.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
colormap_priv.h dix: add AllocColormap() to symbol table for internal wfb module 2025-06-12 17:21:48 +02:00
cursor.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
cursor_priv.h dix: unexport GetSpritePosition() 2024-09-02 16:43:29 +00:00
devices.c os: unexport internal logging functions 2025-06-12 17:21:46 +02:00
dispatch.c os: Do not overflow the integer size with BigRequest 2025-06-17 20:01:25 +02:00
dispatch.h dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
display.c dix: add getter for display name 2025-02-11 19:13:01 +01:00
dix_priv.h dix: export DeliverEvents for nvidia 2025-06-16 10:32:48 +02:00
dixfonts.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
dixgrabs_priv.h dix: let CreateGrab operate on ClientPtr instead of array index 2025-06-12 16:53:37 +02:00
dixstruct_priv.h include: move private defs to dixstruct_priv.h 2024-04-30 00:47:38 +00:00
dixutils.c dix: replace CLIENT_ID() macro by dixClientIdForXID() inline function 2025-06-12 16:53:27 +02:00
enterleave.c Xi: use fixed define for extenion base opcode 2025-06-12 17:21:43 +02:00
enterleave.h dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
eventconvert.c Xi: use fixed define for extenion base opcode 2025-06-12 17:21:43 +02:00
eventconvert.h dix: unexport eventconvert.h functions 2024-03-11 12:26:44 +01:00
events.c dix: refine docs on DeliverDeviceEvents() 2025-06-12 17:21:48 +02:00
exevents_priv.h XI: unexport XIPropToInt() and XIPropToFloat() 2025-06-12 16:25:48 +02:00
extension.c drop Xwayland 2025-06-17 12:51:36 +02:00
extension_priv.h drop Xwayland 2025-06-17 12:51:36 +02:00
gc.c fix name clash on 'GC' between Xlib and Xserver 2025-06-12 16:52:25 +02:00
gc_priv.h dix: replace FreeDefaultStipple() 2025-06-12 16:43:51 +02:00
generate-atoms dix: replace AtomError() by better messages 2025-06-12 16:20:12 +02:00
gestures.c dix: make RESOURCE_CLIENT_MASK macro private 2025-06-12 16:53:53 +02:00
getevents.c dix: clean up including panoramix headers 2025-06-12 17:21:43 +02:00
globals.c dix: add getter for display name 2025-02-11 19:13:01 +01:00
glyphcurs.c dix: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00
grabs.c dix: clean up MakeWindowOptional() calls and add alloc fault checks 2025-06-12 17:21:48 +02:00
input_priv.h Xi: unexport AssignTypeAndName() 2025-06-12 17:21:46 +02:00
inpututils.c dix: let change_modmap() return BadValue instead of -1 2025-06-12 17:21:42 +02:00
lookup.c dix: add dixClientForXID() 2025-06-12 16:53:34 +02:00
main.c dix: add callback for post root window init 2025-06-12 17:21:48 +02:00
meson.build dix: replace wClient() macro by dixClientForWindow() inline function 2025-06-12 16:53:13 +02:00
pixmap.c dix: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00
privates.c dix: remove unused NAMESPACE private type 2025-06-16 10:32:48 +02:00
property.c dix: drop PropertyStateCallback 2025-06-17 12:51:36 +02:00
property_priv.h dix: drop PropertyStateCallback 2025-06-17 12:51:36 +02:00
protocol.txt drop remains of DMX 2024-03-05 16:57:52 +01:00
ptrveloc.c XI: unexport XIPropToInt() and XIPropToFloat() 2025-06-12 16:25:48 +02:00
ptrveloc_priv.h dix: fix duplicate typedef of MotionTracker and *MotionTrackerPtr 2024-09-01 22:32:49 +00:00
region.c dix: use calloc() instead of malloc() 2025-06-12 16:49:43 +02:00
registry.c dix: registry: add LookupDixAccessName() 2025-06-12 17:21:48 +02:00
registry_priv.h dix: registry: add LookupDixAccessName() 2025-06-12 17:21:48 +02:00
reqhandlers_priv.h dix: unexport events related request handlers 2025-06-12 16:16:45 +02:00
resource.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
resource_priv.h dix: unexport and document GetXIDRange() 2025-06-12 16:54:09 +02:00
screen.c dix: add per-screen pixmap destructor mechanism 2025-06-12 16:46:30 +02:00
screen_hooks.c dix: add CreateScreenResources callback mechanism 2025-06-12 16:46:47 +02:00
screen_hooks_priv.h dix: add CreateScreenResources callback mechanism 2025-06-12 16:46:47 +02:00
screenint_priv.h dix: fix duplicate typedef of *ScreenPtr 2024-09-01 22:32:49 +00:00
selection.c dix: add selection filtering hooks 2025-06-12 17:21:48 +02:00
selection_priv.h dix: add selection filtering hooks 2025-06-12 17:21:48 +02:00
stubmain.c Allow DDX to provide a main() 2013-07-23 23:56:58 +01:00
swaprep.c dix: write out X_ListProperties reply directly 2025-06-12 17:21:42 +02:00
swapreq.c dix: unexport events related request handlers 2025-06-12 16:16:45 +02:00
tables.c dix: write out X_ListProperties reply directly 2025-06-12 17:21:42 +02:00
touch.c os: unexport internal logging functions 2025-06-12 17:21:46 +02:00
window.c dix: helper for checking whether window ID belongs to a root window 2025-06-12 17:21:48 +02:00
window_priv.h dix: helper for checking whether window ID belongs to a root window 2025-06-12 17:21:48 +02:00