frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/os
History
Olivier Fourdan d55c54cecb os: Account for bytes to ignore when sharing input buffer 
When reading requests from the clients, the input buffer might be shared
and used between different clients.

If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.

To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.

CVE-2025-49178

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
 		2025-06-17 14:21:24 +02:00
..
.gitignore dix and os: gitignore dix.O and os.O 2011-09-23 17:14:47 -07:00
WaitFor.c os: drop unused TimerCheck() 2025-02-23 17:46:13 +00:00
access.c os: unexport ClientIsLocal() 2025-02-18 10:53:44 +00:00
alloc.c os: move alloc functions to separate source file 2024-02-29 10:09:37 +00:00
audit.h os: unexport audit functions 2024-04-15 19:54:34 +00:00
auth.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
auth.h os: unexport fields from opaque.h not used by modules / drivers 2024-06-23 21:19:27 +00:00
backtrace.c os: backtrace: Fix -Wincompatible-pointer-types compiler error on 32-bit targets 2025-02-07 16:58:02 +02:00
busfault.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
busfault.h os: fix missing include of misc.h in busfault.h 2024-04-16 14:19:59 +02:00
client.c os: split off internal definitions from client.h 2024-10-10 13:45:29 +00:00
client_priv.h os: unexport SetCriticalOutputPending() 2025-02-23 17:39:18 +00:00
cmdline.h os: unexport command line args handling functions 2024-04-15 21:21:40 +00:00
connection.c os: connection.c should include header that defines GrabInProgress 2025-04-19 17:02:15 +00:00
ddx_priv.h os: unexport ddx callbacks 2024-05-08 09:37:35 +02:00
fmt.c os: move out Format*() functions 2024-03-09 17:34:51 +00:00
fmt.h misc.h: unexport compare_version() 2025-02-18 11:17:40 +00:00
inputthread.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
io.c os: Account for bytes to ignore when sharing input buffer 2025-06-17 14:21:24 +02:00
log.c Revert "os: move BUG_*() macros to own private header" 2025-06-13 17:13:54 -07:00
meson.build os: move out LockServer logic from util.c to serverlock.c 2024-07-26 22:26:07 +00:00
mitauth.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
mitauth.h os: move Auth* function types to separate header 2024-02-22 23:42:53 +00:00
osdep.h os: drop `upstart` specific SIGSTOP signaling logic 2025-02-14 14:25:28 +01:00
osinit.c os/osinit: fix build when execinfo.h is missing 2025-02-08 15:22:29 +00:00
ospoll.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
ospoll.h os: Add ospoll interface [v2] 2016-07-21 15:04:47 -04:00
reallocarray.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
screensaver.h os: unexport screen saver timer functions 2024-09-01 20:23:10 +00:00
serverlock.c os: move -nolock help message printing to serverlock.h 2024-07-26 22:26:07 +00:00
serverlock.h os: move -nolock help message printing to serverlock.h 2024-07-26 22:26:07 +00:00
strcasecmp.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
strcasestr.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
string.c os: move string functions to separate source file 2024-02-29 10:09:37 +00:00
strlcat.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
strlcpy.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
strndup.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
timingsafe_memcmp.c timingsafe_memcmp: Fix meson build 2017-05-10 10:56:16 -04:00
utils.c Revert "os: move BUG_*() macros to own private header" 2025-06-13 17:13:54 -07:00
xdmauth.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
xdmauth.h os: move Auth* function types to separate header 2024-02-22 23:42:53 +00:00
xdmcp.c os: if getaddrinfo() is available, use it, even if IPv6 support is disabled 2025-01-27 22:34:51 +00:00
xdmcp.h Fix build with -Dxdmcp=false 2024-02-25 11:55:56 +01:00
xprintf.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
xserver_poll.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
xserver_poll.h os: move xserver_poll.h into os/ directory 2024-06-21 00:53:39 +00:00
xsha1.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
xsha1.h include: move xsha1.h to os/ 2024-03-03 23:11:05 +00:00
xstrans.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00