mirror of
https://github.com/X11Libre/xserver.git
synced 2026-11-12 04:55:49 +00:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
c489be39fc
Fields in XkbClientMapRec and XkbServerMapRec that denote size/num
and are unsigned short can result in truncations. For example
when XkbResizeKeyType() computes the new size_syms value as
(nTotal * 15) / 10, the result may be implicitly truncated to 16
bits on assignment. This causes an undersized calloc allocation, and the
subsequent copy loop writes based on the actual (untruncated) key count,
resulting in a heap buffer overflow. A similar truncation may happen
in XkbResizeKeySyms() and XkbResizeKeyActions().
Widen the fields from unsigned short to unsigned int. These are internal
server structures, not wire protocol types.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-31834
CVE-2026-93518
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit
|
||
| .. | ||
| .gitignore | ||
| callback.h | ||
| client.h | ||
| closure.h | ||
| colormap.h | ||
| colormapst.h | ||
| cursor.h | ||
| cursorstr.h | ||
| displaymode.h | ||
| dix-config-apple-verbatim.h | ||
| dix.h | ||
| dixaccess.h | ||
| dixfont.h | ||
| dixfontstr.h | ||
| dixstruct.h | ||
| events.h | ||
| eventstr.h | ||
| exevents.h | ||
| extension.h | ||
| extinit.h | ||
| extnsionst.h | ||
| fd_notify.h | ||
| fourcc.h | ||
| gc.h | ||
| gcstruct.h | ||
| globals.h | ||
| glx_extinit.h | ||
| glxvndabi.h | ||
| hotplug.h | ||
| input.h | ||
| inputstr.h | ||
| inpututils.h | ||
| list.h | ||
| meson.build | ||
| misc.h | ||
| miscstruct.h | ||
| nonsdk_extinit.h | ||
| opaque.h | ||
| optionstr.h | ||
| os.h | ||
| pixmap.h | ||
| pixmapstr.h | ||
| privates.h | ||
| probes.h | ||
| property.h | ||
| propertyst.h | ||
| protocol-versions.h | ||
| ptrveloc.h | ||
| region.h | ||
| regionstr.h | ||
| resource.h | ||
| rgb.h | ||
| screenint.h | ||
| scrnintstr.h | ||
| servermd.h | ||
| swaprep.h | ||
| swapreq.h | ||
| validate.h | ||
| vidmodestr.h | ||
| window.h | ||
| windowstr.h | ||
| xkb-config.h.in | ||
| xkbrules.h | ||
| xkbsrv.h | ||
| xkbstr.h | ||
| xorg-config.h.meson.in | ||
| xorg-server.h.meson.in | ||
| Xprintf.h | ||
| xserver-properties.h | ||
| Xserver.d | ||
| xwin-config.h.meson.in | ||