frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/dix
History
Peter Hutterer 0c1a93d319 Xi: allocate enough XkbActions for our buttons 
button->xkb_acts is supposed to be an array sufficiently large for all
our buttons, not just a single XkbActions struct. Allocating
insufficient memory here means when we memcpy() later in
XkbSetDeviceInfo we write into memory that wasn't ours to begin with,
leading to the usual security ooopsiedaisies.

CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
 		2023-12-13 10:44:49 +10:00
..
.gitignore Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
BuiltInAtoms R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
atom.c atom: make FreeAtom static 2015-07-08 16:41:29 -04:00
buildatoms XFree86 4.3.0.1 2003-11-14 16:49:22 +00:00
colormap.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
cursor.c dix: Remove -fn and -fc options to set default text/cursor fonts 2019-10-30 16:17:04 +00:00
devices.c Xi: allocate enough XkbActions for our buttons 2023-12-13 10:44:49 +10:00
dispatch.c Remove "All rights reserved" from Oracle copyright notices 2023-02-25 09:40:41 -08:00
dispatch.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
dixfonts.c dix: Use memcpy() instead of memmove() when buffers are known not to overlap 2022-08-29 21:10:51 +00:00
dixutils.c os: Don't crash in AttendClient if the client is gone 2019-11-19 10:15:05 -08:00
enterleave.c Replace "the the" with a single "the" in docs & comments 2022-03-31 13:27:57 -07:00
enterleave.h mi: reset the PointerWindows reference on screen switch 2023-10-25 00:37:47 +00:00
eventconvert.c xi: Implement conversions from internal to Xi2 gesture event structs 2021-05-30 13:26:37 +03:00
events.c Remove "All rights reserved" from Oracle copyright notices 2023-02-25 09:40:41 -08:00
extension.c dix: Use memcpy() instead of memmove() when buffers are known not to overlap 2022-08-29 21:10:51 +00:00
gc.c Use ARRAY_SIZE all over the tree 2017-10-30 13:45:20 -04:00
gestures.c dix: clean up the GestureInfoRec on device close 2023-12-05 14:21:28 +10:00
getevents.c dix: fix wheel emulation lockup when a negative increment is set 2023-02-20 15:11:23 +10:00
globals.c include: Remove now-empty site.h 2019-10-30 16:17:04 +00:00
glyphcurs.c Let calloc handle multiplication 2015-04-21 16:57:07 -07:00
grabs.c xi: Implement grab support for new gesture event types 2021-05-30 13:26:32 +03:00
initatoms.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
inpututils.c Implement gesture processing logic 2021-05-30 13:26:42 +03:00
main.c dix: Remove pScratchPixmap and other associated ABI changes 2022-12-30 01:32:25 +00:00
meson.build dix: Implement internal gesture state handling 2021-05-30 13:26:39 +03:00
pixmap.c dix: Remove pScratchPixmap and other associated ABI changes 2022-12-30 01:32:25 +00:00
privates.c dix/privates.c: Avoid undefined behaviour after realloc() 2021-10-08 09:59:11 +00:00
property.c Xi: avoid integer truncation in length check of ProcXIChangeProperty 2022-12-14 11:02:40 +10:00
protocol.txt protocol.txt: add GLX req. 35 - SetClientInfo2ARB 2018-02-27 13:08:35 -05:00
ptrveloc.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
region.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
registry.c Build required portions of registry.c automatically [v2] 2014-09-18 15:29:29 -07:00
resource.c Remove "All rights reserved" from Oracle copyright notices 2023-02-25 09:40:41 -08:00
selection.c dix: Push UpdateCurrentTimeIf down out of the main loop 2016-05-04 10:58:01 -04:00
stubmain.c Allow DDX to provide a main() 2013-07-23 23:56:58 +01:00
swaprep.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
swapreq.c dix: Disallow GenericEvent in SendEvent request. 2017-06-19 11:58:50 +10:00
tables.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
touch.c xwayland: add -noTouchPointerEmulation 2021-09-06 21:19:46 +00:00
window.c dix: Skip more code in SetRootClip for ROOT_CLIP_INPUT_ONLY 2022-09-12 10:51:05 +00:00