frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/Xi
History
Olivier Fourdan bba9df1a9d Xi: Fix barrier device search 
The function GetBarrierDevice() would search for the pointer device
based on its device id and return the matching value, or supposedly NULL
if no match was found.

Unfortunately, as written, it would return the last element of the list
if no matching device id was found which can lead to out of bounds
memory access.

Fix the search function to return NULL if not matching device is found,
and adjust the callers to handle the case where the device cannot be
found.

CVE-2025-26598, ZDI-CAN-25740

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
 		2025-02-25 11:43:01 +01:00
..
XIstubs.h include: unexport XIstubs.h 2024-09-01 22:21:12 +00:00
allowev.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
allowev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
chgdctl.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
chgdctl.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
chgfctl.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
chgfctl.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
chgkbd.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
chgkbd.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
chgkmap.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
chgkmap.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
chgprop.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
chgprop.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
chgptr.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
chgptr.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
closedev.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
closedev.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
devbell.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
devbell.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
exevents.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
exglobals.h xinput: Remove PropagateMask 2020-03-30 21:48:11 +00:00
extinit.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getbmap.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getbmap.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getdctl.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
getdctl.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
getfctl.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getfctl.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getfocus.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getfocus.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getkmap.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getkmap.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getmmap.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getmmap.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
getprop.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
getprop.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
getselev.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
getselev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
getvers.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
getvers.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
grabdev.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
grabdev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
grabdevb.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
grabdevb.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
grabdevk.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
grabdevk.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
gtmotion.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
gtmotion.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
listdev.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
listdev.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
meson.build Add a Meson build system alongside autotools. 2017-04-26 15:25:27 -07:00
opendev.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
opendev.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
queryst.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
queryst.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
selectev.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
selectev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
sendexev.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
sendexev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
setbmap.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
setbmap.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
setdval.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
setdval.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
setfocus.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
setfocus.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
setmmap.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
setmmap.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
setmode.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
setmode.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
stubs.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
ungrdev.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
ungrdev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
ungrdevb.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
ungrdevb.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
ungrdevk.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
ungrdevk.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xiallowev.c misc.h: unexport compare_version() 2025-02-18 11:17:40 +00:00
xiallowev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xibarriers.c Xi: Fix barrier device search 2025-02-25 11:43:01 +01:00
xibarriers.h Xi: free barrier code at reset time 2013-05-07 09:41:19 +10:00
xichangecursor.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
xichangecursor.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xichangehierarchy.c drop not needed includes of geext.h 2025-02-24 20:19:55 +00:00
xichangehierarchy.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
xigetclientpointer.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
xigetclientpointer.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xigrabdev.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
xigrabdev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xipassivegrab.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
xipassivegrab.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xiproperty.c Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
xiproperty.h Xi: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
xiquerydevice.c misc.h: unexport compare_version() 2025-02-18 11:17:40 +00:00
xiquerydevice.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xiquerypointer.c misc.h: unexport compare_version() 2025-02-18 11:17:40 +00:00
xiquerypointer.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xiqueryversion.c misc.h: unexport compare_version() 2025-02-18 11:17:40 +00:00
xiqueryversion.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xiselectev.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
xiselectev.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xisetclientpointer.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
xisetclientpointer.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xisetdevfocus.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
xisetdevfocus.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
xiwarppointer.c Xi: drop swapping request length fields 2025-02-06 22:28:51 +00:00
xiwarppointer.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00