mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-07 16:59:22 +00:00
Code Issues Projects Releases Wiki Activity

libX11: CVE-2022-3554 & CVE-2022-3555 Fix memory leak

Browse Source 
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1d11822601fd24a396b354fa616b04ed3df8b4ef && https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8a368d808fec166b5fb3dfe6312aab22c7ee20af

(From OE-Core rev: b0e0cf44fb4f6e1cf562860766a2915ee8718f77)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hitendra Prajapati
2022-12-26 10:15:16 +05:30
committed by Richard Purdie
parent 192cb88c17
commit 2d58f993c3
3 changed files with 100 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-graphics/xorg-lib/libx11/CVE-2022-3554.patch
+58
View File
@@ -0,0 +1,58 @@
From 1d11822601fd24a396b354fa616b04ed3df8b4ef Mon Sep 17 00:00:00 2001
From: "Thomas E. Dickey" <dickey@invisible-island.net>
Date: Tue, 4 Oct 2022 18:26:17 -0400
Subject: [PATCH] fix a memory leak in XRegisterIMInstantiateCallback
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1d11822601fd24a396b354fa616b04ed3df8b4ef]
CVE: CVE-2022-3554
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
fix a memory leak in XRegisterIMInstantiateCallback
Analysis:
_XimRegisterIMInstantiateCallback() opens an XIM and closes it using
the internal function pointers, but the internal close function does
not free the pointer to the XIM (this would be done in XCloseIM()).
Report/patch:
Date: Mon, 03 Oct 2022 18:47:32 +0800
From: Po Lu <luangruo@yahoo.com>
To: xorg-devel@lists.x.org
Subject: Re: Yet another leak in Xlib
For reference, here's how I'm calling XRegisterIMInstantiateCallback:
XSetLocaleModifiers ("");
XRegisterIMInstantiateCallback (compositor.display,
XrmGetDatabase (compositor.display),
(char *) compositor.resource_name,
(char *) compositor.app_name,
IMInstantiateCallback, NULL);
and XMODIFIERS is:
@im=ibus
Signed-off-by: Thomas E. Dickey's avatarThomas E. Dickey <dickey@invisible-island.net>
---
modules/im/ximcp/imInsClbk.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/modules/im/ximcp/imInsClbk.c b/modules/im/ximcp/imInsClbk.c
index 95b379c..c10e347 100644
--- a/modules/im/ximcp/imInsClbk.c
+++ b/modules/im/ximcp/imInsClbk.c
@@ -212,6 +212,9 @@ _XimRegisterIMInstantiateCallback(
if( xim ) {
lock = True;
xim->methods->close( (XIM)xim );
+ /* XIMs must be freed manually after being opened; close just
+ does the protocol to deinitialize the IM. */
+ XFree( xim );
lock = False;
icb->call = True;
callback( display, client_data, NULL );
--
2.25.1
meta/recipes-graphics/xorg-lib/libx11/CVE-2022-3555.patch
+40
View File
@@ -0,0 +1,40 @@
From 8a368d808fec166b5fb3dfe6312aab22c7ee20af Mon Sep 17 00:00:00 2001
From: Hodong <hodong@yozmos.com>
Date: Thu, 20 Jan 2022 00:57:41 +0900
Subject: [PATCH] Fix two memory leaks in _XFreeX11XCBStructure()
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8a368d808fec166b5fb3dfe6312aab22c7ee20af]
CVE: CVE-2022-3555
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Fix two memory leaks in _XFreeX11XCBStructure()
Even when XCloseDisplay() was called, some memory was leaked.
XCloseDisplay() calls _XFreeDisplayStructure(), which calls
_XFreeX11XCBStructure().
However, _XFreeX11XCBStructure() did not destroy the condition variables,
resulting in the leaking of some 40 bytes.
Signed-off-by: default avatarHodong <hodong@yozmos.com>
---
src/xcb_disp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/xcb_disp.c b/src/xcb_disp.c
index 70a602f..e9becee 100644
--- a/src/xcb_disp.c
+++ b/src/xcb_disp.c
@@ -102,6 +102,8 @@ void _XFreeX11XCBStructure(Display *dpy)
dpy->xcb->pending_requests = tmp->next;
free(tmp);
}
+ xcondition_clear(dpy->xcb->event_notify);
+ xcondition_clear(dpy->xcb->reply_notify);
xcondition_free(dpy->xcb->event_notify);
xcondition_free(dpy->xcb->reply_notify);
Xfree(dpy->xcb);
--
2.25.1
meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb
+2
View File
@@ -15,6 +15,8 @@ PE = "1"
SRC_URI = "${XORG_MIRROR}/individual/lib/${XORG_PN}-${PV}.tar.xz"
SRC_URI += "file://disable_tests.patch \
file://CVE-2022-3554.patch \
file://CVE-2022-3555.patch \
"
SRC_URI[sha256sum] = "2ffd417266fb875028fdc0ef349694f63dbcd76d0b0cfacfb52e6151f4b60989"