hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-28 02:21:08 +00:00
Code Issues Projects Releases Wiki Activity

randr: fix heap overflow and size tracking in RRChangeProviderProperty

Browse source 
In PropModePrepend mode, old_data was offset by prop_value->size *
size_in_bytes instead of len * size_in_bytes, causing a heap buffer
overflow whenever the existing property is larger than the new data
being prepended.

Additionally, new_value.size was set to len instead of total_len in
Append and Prepend modes, causing the stored property size to reflect
only the new elements rather than the full property after the operation.

rrproperty.c (the RROutput equivalent) already has both correct forms,
this brings rrproviderproperty.c in line with it.

Signed-off-by: Victor Lev <levvictor123@gmail.com>

(cherry picked from commit 826a3cc93d)
This commit is contained in:
levvictor 2026-06-23 15:07:13 +02:00 • committed by Enrico Weigelt
commit 45323dd375
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
randr/rrproviderproperty.c
View file

@ -182,7 +182,7 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type,
cleanupProperty(prop, add);
return BadAlloc;
}
new_value.size = len;
new_value.size = total_len;
new_value.type = type;
new_value.format = format;
@ -199,7 +199,7 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type,
case PropModePrepend:
new_data = new_value.data;
old_data = (void *) (((char *) new_value.data) +
(prop_value->size * size_in_bytes));
(len * size_in_bytes));
break;
}
if (new_data)