XLibre Xserver
Go to file
Peter Hutterer f2922f6ffa Xi/randr: fix handling of PropModeAppend/Prepend
The handling of appending/prepending properties was incorrect, with at
least two bugs: the property length was set to the length of the new
part only, i.e. appending or prepending N elements to a property with P
existing elements always resulted in the property having N elements
instead of N + P.

Second, when pre-pending a value to a property, the offset for the old
values was incorrect, leaving the new property with potentially
uninitalized values and/or resulting in OOB memory writes.
For example, prepending a 3 element value to a 5 element property would
result in this 8 value array:
  [N, N, N, ?, ?, P, P, P ] P, P
                            ^OOB write

The XI2 code is a copy/paste of the RandR code, so the bug exists in
both.

CVE-2023-5367, ZDI-CAN-22153

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 541ab2ecd4)
2023-10-25 10:51:17 +10:00
.gitlab-ci ci: Install libxcvt from git 2021-08-06 11:29:29 +00:00
Xext Xext: fix invalid event type mask in XTestSwapFakeInput 2022-12-19 13:49:37 +10:00
Xi Xi/randr: fix handling of PropModeAppend/Prepend 2023-10-25 10:51:17 +10:00
composite composite: Fix use-after-free of the COW 2023-03-29 14:20:26 +02:00
config config: Fix platform busid parsing when there is no ID_PATH prop 2021-06-25 13:24:51 +03:00
damageext More missing version checks in SProcs 2021-08-08 12:43:01 +00:00
dbe meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
dix dix: Use CopyPartialInternalEvent in EnqueueEvent 2023-02-07 10:21:52 +10:00
doc meson: Implement developer documentation build 2021-08-20 10:26:07 +00:00
dri3 meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
exa exa: rename some badly named variables 2020-07-10 06:17:40 +10:00
fb meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
glamor glamor: fix free of uninitialised pointers 2021-12-04 18:05:29 +02:00
glx glx/dri: Filter out fbconfigs that don't have a supported pixmap format 2022-01-01 14:46:19 +02:00
hw xquartz: Disable COMPOSITE at runtime 2023-01-17 15:19:10 -08:00
include Switch to libbsd-overlay 2023-10-23 23:30:14 -04:00
m4 Add ax_pthread.m4 to m4/ 2016-05-29 19:20:51 -07:00
man Drop DMX DDX 2021-09-07 09:34:31 +00:00
mi Implement gesture processing logic 2021-05-30 13:26:42 +03:00
miext rootless: Add additional debug logging to help triage XQuartz fb/rootless/damage crashes 2022-12-21 01:23:50 -08:00
os Switch to libbsd-overlay 2023-10-23 23:30:14 -04:00
present present: Send a PresentConfigureNotify event for destroyed windows 2023-04-24 10:13:27 +02:00
pseudoramiX Unvalidated lengths 2017-10-10 23:33:34 +02:00
randr Xi/randr: fix handling of PropModeAppend/Prepend 2023-10-25 10:51:17 +10:00
record record: Fix out of bounds access in SwapCreateRegister() 2021-12-15 10:41:18 +02:00
render render: Fix build with gcc 12 2022-01-28 10:36:28 +01:00
test tests: Fix build failure from missing micmap.c 2022-06-26 03:03:26 -07:00
xfixes xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier() 2021-12-15 10:41:19 +02:00
xkb xkbUtils: use existing symbol names instead of deleted deprecated ones 2023-03-29 10:14:00 +02:00
.appveyor.yml Drop DMX DDX 2021-09-07 09:34:31 +00:00
.dir-locals.el .dir-locals.el: Add missing final newline 2019-10-01 17:05:28 +00:00
.gitignore .gitignore: Add new autotools file 'test-driver' 2014-04-21 13:41:42 -07:00
.gitlab-ci.yml ci: Install libxcvt from git 2021-08-06 11:29:29 +00:00
.travis.yml travis: Add OSX meson build to matrix 2019-05-02 15:42:58 +00:00
COPYING modesetting: Merge modesetting's COPYING into the xserver's. 2014-09-15 12:46:02 -07:00
Makefile.am Makefile.am: Add missing meson build files to release tarball 2021-11-06 21:22:23 +02:00
README.md Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
autogen.sh autogen: Set a default subject prefix for patches 2016-02-08 17:41:38 -05:00
configure.ac Switch to libbsd-overlay 2023-10-23 23:30:14 -04:00
devbook.am doc: Create a script to filter xmlto output 2015-01-05 14:24:06 -08:00
docbook.am docbook.am: embed css styles inside the HTML HEAD element 2011-09-21 14:07:49 -07:00
manpages.am man: Fix automake seddery 2018-05-08 12:15:30 -04:00
meson.build Switch to libbsd-overlay 2023-10-23 23:30:14 -04:00
meson_options.txt meson: Provide options to set CFBundleVersion and CFBundleVersionString in XQuartz 2022-06-19 23:10:48 -07:00
xorg-server.m4 xorg-server.m4: just all cflags instead of just sdkdir 2018-09-20 20:12:24 +01:00
xorg-server.pc.in xfree86: link modules against Xorg symbols on Cygwin 2012-04-05 21:57:07 -05:00
xserver.ent.in doc: relocate xserver.ent in the package root directory 2011-05-14 11:22:26 -07:00

X Server

The X server accepts requests from client applications to create windows, which are (normally rectangular) "virtual screens" that the client program can draw into.

Windows are then composed on the actual screen by the X server (or by a separate composite manager) as directed by the window manager, which usually communicates with the user via graphical controls such as buttons and draggable titlebars and borders.

For a comprehensive overview of X Server and X Window System, consult the following article: https://en.wikipedia.org/wiki/X_server

All questions regarding this software should be directed at the Xorg mailing list:

https://lists.freedesktop.org/mailman/listinfo/xorg

The primary development code repository can be found at:

https://gitlab.freedesktop.org/xorg/xserver

For patch submission instructions, see:

https://www.x.org/wiki/Development/Documentation/SubmittingPatches

As with other projects hosted on freedesktop.org, X.Org follows its Code of Conduct, based on the Contributor Covenant. Please conduct yourself in a respectful and civilized manner when using the above mailing lists, bug trackers, etc:

https://www.freedesktop.org/wiki/CodeOfConduct