hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-15 05:23:40 +00:00
Code Issues Projects Releases Wiki Activity
xserver/Xext/xkeyboard
History
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer bae088ccbd xkb: fix CheckKeySyms overwriting request-range symsPerKey entries 
CheckKeySyms() has two loops: the first processes keys in the SetMap
request range, the second fills in any missing keys from the existing
map.

The indexing between the two was inconsistent: the first loop
uses a zero-based index + req->firstKeySym, the second loop used it just
as zero-based index.

Example:
   req->firstKeySym = 50
   req->nKeySyms = 10

  i goes from 0 to 10,
  loop 1 checks [50, 60), changes the width but finishes with i at 10.
  loop 2 then runs over [10, 255(, copying the old keymap width

The second loop overwrites the new widths with the width of the
existing keymap. The subsequent SetKeySyms worked on the new width
and may write fewer actions than the map width.

A subsequent XkbGetMap request would then read XkbKeyNumActions()
entries (derived from the new wider key_sym_map.width) from the shorter
action allocation, causing an out-of-bounds heap read. The overread
bytes would be copied into the GetMap reply and sent back to the client,
producing a bounded heap information disclosure.

This vulnerability was discovered by:
  WONJOON HWANG (@joon1337) working with TrendAI Zero Day Initiative

ZDI-CAN-32408

CVE-2026-93524

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit cea71d0273)

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2026-10-20 19:54:36 +02:00
..
ddxBeep.c Handle -Wimplicit-fallthrough warnings from gcc 16.1 2026-09-30 21:03:21 +02:00
ddxCtrls.c
ddxKillSrv.c
ddxLEDs.c
ddxLoad.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
ddxPrivate.c
ddxVT.c
maprules.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
meson.build
README.compiled
xkb-procs.h
xkb.c xkb: fix CheckKeySyms overwriting request-range symsPerKey entries 2026-10-20 19:54:36 +02:00
xkbAccessX.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
xkbActions.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
XKBAlloc.c xkb: allocate names->keys to MAP_LENGTH in XkbAllocNames 2026-10-20 19:54:36 +02:00
xkbDflts.h
xkbEvents.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
xkbfile_priv.h
xkbfmisc.c xkb: parentheses around macro argument symbols 2026-06-25 06:55:06 +02:00
xkbfmisc_priv.h
XKBGAlloc.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
xkbgeom_priv.h
xkbInit.c xkb: Default to one group whenever a keymap reports none 2026-10-01 17:36:35 +02:00
xkbLEDs.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
XKBMAlloc.c xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int 2026-10-20 19:54:36 +02:00
XKBMisc.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
xkbout.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
xkbout_priv.h
xkbPrKeyEv.c
xkbrules_priv.h
xkbsrv_priv.h xkb: parentheses around macro argument symbols 2026-06-25 06:55:06 +02:00
xkbtext.c xext: xkeyboard: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:23:51 +02:00
xkbtext_priv.h
xkbUtils.c xkb: Guard XkbAdjustGroup() against a keymap with no groups 2026-10-01 19:01:38 +02:00
XKM_file_format.txt
xkmread.c xkb: reject incomplete keymaps in GetKbdByName 2026-10-20 19:51:15 +02:00

README.compiled 

The X server uses this directory to store the compiled version of the
current keymap and/or any scratch keymaps used by clients.  The X server
or some other tool might destroy or replace the files in this directory,
so it is not a safe place to store compiled keymaps for long periods of
time.  The default keymap for any server is usually stored in:
     X<num>-default.xkm
where <num> is the display number of the server in question, which makes
it possible for several servers *on the same host* to share the same 
directory.

Unless the X server is modified, sharing this directory between servers on
different hosts could cause problems.