hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-28 02:21:08 +00:00
Code Issues Projects Releases Wiki Activity

xfree86: pad the DGA QueryModes reply name to its announced length

Browse source 
Adapted backport of #3173 (master commit 9fd97d52cf) for the 25.0 reply
path, which still uses WriteToClient() (pre-x_rpcbuf).

ProcXDGAQueryModes computes both rep.length and info.name_size with each
mode name padded to a 4-byte boundary (pad_to_int32), but wrote only
strlen(name)+1 bytes for the name itself. The server thus announced more
bytes than it sent, leaving the reply short of rep.length and desyncing
the client. Pad the name write up to the 4-byte boundary with zeroes --
not by writing info.name_size bytes straight from the name buffer, which
would over-read past the terminating NUL and leak adjacent memory.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult 2026-06-30 16:57:31 +02:00 • committed by Enrico Weigelt
commit f867a7bbfc
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
hw/xfree86/common/xf86DGA.c
View file

@ -1367,6 +1367,21 @@ ProcXDGAQueryModes(ClientPtr client)
WriteToClient(client, sz_xXDGAModeInfo, (char *) (&info));
WriteToClient(client, size, mode[i].name);
/* rep.length and info.name_size both account for the name padded
* to a 4-byte boundary (see the size computation above), so the
* bytes actually written must match — otherwise the reply is
* short of its announced length and the client desyncs. Pad with
* zeroes; do not write info.name_size bytes straight from the name
* buffer, which would over-read past the terminating NUL. */
{
int namepad = pad_to_int32(size) - size;
if (namepad) {
static const char zeros[3] = { 0, 0, 0 };
WriteToClient(client, namepad, (char *) zeros);
}
}
}
free(mode);