XLibre Xserver
Go to file
Peter Hutterer 8a1fa008b2 Xi: avoid integer truncation in length check of ProcXIChangeProperty
This fixes an OOB read and the resulting information disclosure.

Length calculation for the request was clipped to a 32-bit integer. With
the correct stuff->num_items value the expected request size was
truncated, passing the REQUEST_FIXED_SIZE check.

The server then proceeded with reading at least stuff->num_items bytes
(depending on stuff->format) from the request and stuffing whatever it
finds into the property. In the process it would also allocate at least
stuff->num_items bytes, i.e. 4GB.

The same bug exists in ProcChangeProperty and ProcXChangeDeviceProperty,
so let's fix that too.

CVE-2022-46344, ZDI-CAN 19405

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit 8f454b793e)
2022-12-14 11:24:46 +10:00
.gitlab-ci ci: Install libxcvt from git 2021-08-06 11:29:29 +00:00
Xext Xext: free the screen saver resource when replacing it 2022-12-14 11:24:43 +10:00
Xi Xi: avoid integer truncation in length check of ProcXIChangeProperty 2022-12-14 11:24:46 +10:00
composite meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
config config: Fix platform busid parsing when there is no ID_PATH prop 2021-06-25 13:24:51 +03:00
damageext More missing version checks in SProcs 2021-08-08 12:43:01 +00:00
dbe meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
dix Xi: avoid integer truncation in length check of ProcXIChangeProperty 2022-12-14 11:24:46 +10:00
doc meson: Implement developer documentation build 2021-08-20 10:26:07 +00:00
dri3 meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
exa exa: rename some badly named variables 2020-07-10 06:17:40 +10:00
fb meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
glamor glamor: fix free of uninitialised pointers 2021-12-04 18:05:29 +02:00
glx glx/dri: Filter out fbconfigs that don't have a supported pixmap format 2022-01-01 14:46:19 +02:00
hw xquartz: Move default applications list outside of the main executable 2022-11-24 11:38:42 -08:00
include meson: Don't build COMPOSITE for XQuartz 2022-11-27 15:15:21 -08:00
m4 Add ax_pthread.m4 to m4/ 2016-05-29 19:20:51 -07:00
man Drop DMX DDX 2021-09-07 09:34:31 +00:00
mi Implement gesture processing logic 2021-05-30 13:26:42 +03:00
miext rootless: Dead code removal (ROOTLESS_REDISPLAY_DELAY is already defined) 2022-06-14 23:36:39 -07:00
os Revert "os: Try to discover the current seat with the XDG_SEAT var first" 2022-07-01 15:13:01 +03:00
present present: Check for NULL to prevent crash 2022-01-19 11:04:14 -08:00
pseudoramiX Unvalidated lengths 2017-10-10 23:33:34 +02:00
randr Fix RandR leasing for more than 1 simultaneously active lease. 2021-10-21 13:08:01 +03:00
record record: Fix out of bounds access in SwapCreateRegister() 2021-12-15 10:41:18 +02:00
render render: Fix build with gcc 12 2022-01-28 10:36:28 +01:00
test tests: Fix build failure from missing micmap.c 2022-06-26 03:03:26 -07:00
xfixes xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier() 2021-12-15 10:41:19 +02:00
xkb xkb: add request length validation for XkbSetGeometry 2022-07-12 15:24:59 +03:00
.appveyor.yml Drop DMX DDX 2021-09-07 09:34:31 +00:00
.dir-locals.el .dir-locals.el: Add missing final newline 2019-10-01 17:05:28 +00:00
.gitignore .gitignore: Add new autotools file 'test-driver' 2014-04-21 13:41:42 -07:00
.gitlab-ci.yml ci: Install libxcvt from git 2021-08-06 11:29:29 +00:00
.travis.yml travis: Add OSX meson build to matrix 2019-05-02 15:42:58 +00:00
COPYING modesetting: Merge modesetting's COPYING into the xserver's. 2014-09-15 12:46:02 -07:00
Makefile.am Makefile.am: Add missing meson build files to release tarball 2021-11-06 21:22:23 +02:00
README.md Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
autogen.sh autogen: Set a default subject prefix for patches 2016-02-08 17:41:38 -05:00
configure.ac xserver 21.1.4 2022-07-12 16:09:23 +03:00
devbook.am doc: Create a script to filter xmlto output 2015-01-05 14:24:06 -08:00
docbook.am docbook.am: embed css styles inside the HTML HEAD element 2011-09-21 14:07:49 -07:00
manpages.am man: Fix automake seddery 2018-05-08 12:15:30 -04:00
meson.build meson: Don't build COMPOSITE for XQuartz 2022-11-27 15:15:21 -08:00
meson_options.txt meson: Provide options to set CFBundleVersion and CFBundleVersionString in XQuartz 2022-06-19 23:10:48 -07:00
xorg-server.m4 xorg-server.m4: just all cflags instead of just sdkdir 2018-09-20 20:12:24 +01:00
xorg-server.pc.in xfree86: link modules against Xorg symbols on Cygwin 2012-04-05 21:57:07 -05:00
xserver.ent.in doc: relocate xserver.ent in the package root directory 2011-05-14 11:22:26 -07:00

X Server

The X server accepts requests from client applications to create windows, which are (normally rectangular) "virtual screens" that the client program can draw into.

Windows are then composed on the actual screen by the X server (or by a separate composite manager) as directed by the window manager, which usually communicates with the user via graphical controls such as buttons and draggable titlebars and borders.

For a comprehensive overview of X Server and X Window System, consult the following article: https://en.wikipedia.org/wiki/X_server

All questions regarding this software should be directed at the Xorg mailing list:

https://lists.freedesktop.org/mailman/listinfo/xorg

The primary development code repository can be found at:

https://gitlab.freedesktop.org/xorg/xserver

For patch submission instructions, see:

https://www.x.org/wiki/Development/Documentation/SubmittingPatches

As with other projects hosted on freedesktop.org, X.Org follows its Code of Conduct, based on the Contributor Covenant. Please conduct yourself in a respectful and civilized manner when using the above mailing lists, bug trackers, etc:

https://www.freedesktop.org/wiki/CodeOfConduct