hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-28 02:21:08 +00:00
Code Issues Projects Releases Wiki Activity

xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int

Browse source 
Fields in XkbClientMapRec and XkbServerMapRec that denote size/num
and are unsigned short can result in truncations. For example
when XkbResizeKeyType() computes the new size_syms value as
(nTotal * 15) / 10, the result may be implicitly truncated to 16
bits on assignment. This causes an undersized calloc allocation, and the
subsequent copy loop writes based on the actual (untruncated) key count,
resulting in a heap buffer overflow. A similar truncation may happen
in XkbResizeKeySyms() and XkbResizeKeyActions().

Widen the fields from unsigned short to unsigned int. These are internal
server structures, not wire protocol types.

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-31834

CVE-2026-93518

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit 89101a6c66)
This commit is contained in:
Peter Hutterer 2026-08-26 16:57:38 +10:00 • committed by Enrico Weigelt
commit c489be39fc
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
include/xkbstr.h
View file

@ -312,8 +312,8 @@ typedef struct _XkbControls {
XkbAX_NeedOption((c), (w)))
typedef struct _XkbServerMapRec {
unsigned short num_acts;
unsigned short size_acts;
unsigned int num_acts;
unsigned int size_acts;
XkbAction *acts;
XkbBehavior *behaviors;
@ -346,8 +346,8 @@ typedef struct _XkbClientMapRec {
unsigned char num_types;
XkbKeyTypePtr types;
unsigned short size_syms;
unsigned short num_syms;
unsigned int size_syms;
unsigned int num_syms;
KeySym *syms;
XkbSymMapPtr key_sym_map;

3
xkb/XKBMAlloc.c
View file

@ -386,7 +386,8 @@ XkbResizeKeyType(XkbDescPtr xkb,
}
if (nResize > 0) {
int nextMatch;
if (nTotal > INT_MAX / 15)
return BadAlloc;
xkb->map->size_syms = (nTotal * 15) / 10;
newSyms = calloc(xkb->map->size_syms, sizeof(KeySym));
if (newSyms == NULL)