frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/os
History
Olivier Fourdan 0d6af5a542 os: Account for bytes to ignore when sharing input buffer 
When reading requests from the clients, the input buffer might be shared
and used between different clients.

If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.

To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.

CVE-2025-49178

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
 		2025-06-17 20:01:25 +02:00
..
.gitignore dix and os: gitignore dix.O and os.O 2011-09-23 17:14:47 -07:00
WaitFor.c os: drop unused TimerCheck() 2025-02-23 17:46:13 +00:00
access.c drop remains of cygwin support 2025-06-12 17:21:46 +02:00
alloc.c os: use calloc() instead of malloc() 2025-06-12 16:49:45 +02:00
audit.h os: unexport audit functions 2024-04-15 19:54:34 +00:00
auth.c os: auth: let GenerateAuthorization() return 0 on error 2025-06-12 16:52:59 +02:00
auth.h os: auth: generate XIDs in proto funcs only on success 2025-06-12 16:52:56 +02:00
backtrace.c os: backtrace: Fix -Wincompatible-pointer-types compiler error on 32-bit targets 2025-02-07 16:58:02 +02:00
bug_priv.h os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
busfault.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
busfault.h os: fix missing include of misc.h in busfault.h 2024-04-16 14:19:59 +02:00
client.c os: unexport internal logging functions 2025-06-12 17:21:46 +02:00
client_priv.h os: export SetCriticalOutputPending for nvidia 2025-06-16 10:32:48 +02:00
cmdline.c os: helper for parsing an counting-flag or value-flag option 2025-06-12 17:21:46 +02:00
cmdline.h os: helper for parsing an counting-flag or value-flag option 2025-06-12 17:21:46 +02:00
connection.c xnest/os: Fix incorrect power of two operator 2025-06-13 13:27:25 +02:00
ddx_priv.h os: unexport ddx callbacks 2024-05-08 09:37:35 +02:00
fmt.c os: move out Format*() functions 2024-03-09 17:34:51 +00:00
fmt.h os: unexport xstrtokenize() 2025-06-12 17:21:44 +02:00
inputthread.c os: unexport internal logging functions 2025-06-12 17:21:46 +02:00
io.c os: Account for bytes to ignore when sharing input buffer 2025-06-17 20:01:25 +02:00
log.c os: fix missing NULL check for vpnprintf() 2025-06-16 20:28:01 +02:00
log_priv.h os: log: add syslog support 2025-06-12 17:21:46 +02:00
meson.build os: drop own implementation of strcasecmp() and strncasecmp() 2025-06-12 17:21:46 +02:00
mitauth.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
mitauth.h os: auth: generate XIDs in proto funcs only on success 2025-06-12 16:52:56 +02:00
osdep.h os: move xdm function vector types from osdep.h to xdmcp.h 2025-06-12 17:21:47 +02:00
osinit.c os: unexport internal logging functions 2025-06-12 17:21:46 +02:00
ospoll.c os: ospoll_create(): protect from allocation failure 2025-06-12 16:35:42 +02:00
ospoll.h os: Add ospoll interface [v2] 2016-07-21 15:04:47 -04:00
reallocarray.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
screensaver.h os: unexport screen saver timer functions 2024-09-01 20:23:10 +00:00
serverlock.c os: move -nolock help message printing to serverlock.h 2024-07-26 22:26:07 +00:00
serverlock.h os: move -nolock help message printing to serverlock.h 2024-07-26 22:26:07 +00:00
strcasecmp.c os: drop own implementation of strcasecmp() and strncasecmp() 2025-06-12 17:21:46 +02:00
strcasestr.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
string.c os: unexport xstrtokenize() 2025-06-12 17:21:44 +02:00
strlcat.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
strlcpy.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
strndup.c os: use calloc() instead of malloc() 2025-06-12 16:49:45 +02:00
timingsafe_memcmp.c timingsafe_memcmp: Fix meson build 2017-05-10 10:56:16 -04:00
utils.c os: fix missing include of Xext/xf86bigfontsrv.h 2025-06-12 17:21:48 +02:00
xdmauth.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
xdmauth.h os: auth: generate XIDs in proto funcs only on success 2025-06-12 16:52:56 +02:00
xdmcp.c os: xdmcp: simplify AddAuth handler call 2025-06-12 16:53:03 +02:00
xdmcp.h os: move xdm function vector types from osdep.h to xdmcp.h 2025-06-12 17:21:47 +02:00
xprintf.c os: drop deprecated Xprintf() 2025-06-12 16:54:27 +02:00
xserver_poll.c drop remains of cygwin support 2025-06-12 17:21:46 +02:00
xserver_poll.h os: move xserver_poll.h into os/ directory 2024-06-21 00:53:39 +00:00
xsha1.c os: use calloc() instead of malloc() 2025-06-12 16:49:45 +02:00
xsha1.h include: move xsha1.h to os/ 2024-03-03 23:11:05 +00:00
xstrans.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00