mirror of
https://git.yoctoproject.org/poky
synced 2026-06-02 01:19:52 +00:00
Jackie Huang
e99089ce24
Backport 3 patches to fix CVE-2017-10971: In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-10971 (From OE-Core rev: 20428f660f2c046c63bbf63c4e4af95dac9f2b3d) (From OE-Core rev: 8c42a9508bded870d1ac018e2cfa129772983c52) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
51 lines
1.7 KiB
Diff
51 lines
1.7 KiB
Diff
From ba336b24052122b136486961c82deac76bbde455 Mon Sep 17 00:00:00 2001
|
|
From: Michal Srb <msrb@suse.com>
|
|
Date: Wed, 24 May 2017 15:54:42 +0300
|
|
Subject: [PATCH] Xi: Do not try to swap GenericEvent.
|
|
|
|
The SProcXSendExtensionEvent must not attempt to swap GenericEvent because
|
|
it is assuming that the event has fixed size and gives the swapping function
|
|
xEvent-sized buffer.
|
|
|
|
A GenericEvent would be later rejected by ProcXSendExtensionEvent anyway.
|
|
|
|
Signed-off-by: Michal Srb <msrb@suse.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
|
|
CVE: CVE-2017-10971
|
|
|
|
Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455]
|
|
|
|
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
|
|
---
|
|
Xi/sendexev.c | 10 +++++++++-
|
|
1 file changed, 9 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
|
|
index 5e63bfc..5c2e0fc 100644
|
|
--- a/Xi/sendexev.c
|
|
+++ b/Xi/sendexev.c
|
|
@@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client)
|
|
|
|
eventP = (xEvent *) &stuff[1];
|
|
for (i = 0; i < stuff->num_events; i++, eventP++) {
|
|
+ if (eventP->u.u.type == GenericEvent) {
|
|
+ client->errorValue = eventP->u.u.type;
|
|
+ return BadValue;
|
|
+ }
|
|
+
|
|
proc = EventSwapVector[eventP->u.u.type & 0177];
|
|
- if (proc == NotImplemented) /* no swapping proc; invalid event type? */
|
|
+ /* no swapping proc; invalid event type? */
|
|
+ if (proc == NotImplemented) {
|
|
+ client->errorValue = eventP->u.u.type;
|
|
return BadValue;
|
|
+ }
|
|
(*proc) (eventP, &eventT);
|
|
*eventP = eventT;
|
|
}
|
|
--
|
|
1.7.9.5
|
|
|