SecBSD
/
xenocara
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Need to use unswapped length to send reply in ProcXIGetSelectedEvents() (CVE-2024-31080) and ProcXiPassiveGrabDevice() (CVE-2024-31081)

This commit is contained in:
purplerain 2024-04-04 10:21:45 +00:00
parent 5cf6ab0cf4
commit f29b6fb075
Signed by: purplerain
GPG Key ID: F42C07F07E2E35B7
2 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
xserver/Xi/xipassivegrab.c
View File

@ -247,9 +247,18 @@ ProcXIPassiveGrabDevice(ClientPtr client)
}
}
WriteReplyToClient(client, sizeof(rep), &rep);
if (rep.num_modifiers)
WriteToClient(client, rep.length * 4, modifiers_failed);
if (client->swapped) {
/* save the value before SRepXIPassiveGrabDevice swaps it */
uint32_t length = rep.length;
WriteReplyToClient(client, sizeof(rep), &rep);
if (length)
WriteToClient(client, length * 4, modifiers_failed);
}
else {
WriteReplyToClient(client, sizeof(rep), &rep);
if (rep.num_modifiers)
WriteToClient(client, rep.length * 4, modifiers_failed);
}
out:
free(modifiers_failed);

17
xserver/Xi/xiselectev.c
View File

@ -418,10 +418,21 @@ ProcXIGetSelectedEvents(ClientPtr client)
}
}
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
if (client->swapped) {
/* save the value before SRepXIGetSelectedEvents swaps it */
uint32_t length = reply.length;
if (reply.num_masks)
WriteToClient(client, reply.length * 4, buffer);
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
if (length)
WriteToClient(client, length * 4, buffer);
}
else {
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
if (reply.num_masks)
WriteToClient(client, reply.length * 4, buffer);
}
free(buffer);
return Success;