Peter Hutterer
4d6f715f77
xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int ...
Fields in XkbClientMapRec and XkbServerMapRec that denote size/num
and are unsigned short can result in truncations. For example
when XkbResizeKeyType() computes the new size_syms value as
(nTotal * 15) / 10, the result may be implicitly truncated to 16
bits on assignment. This causes an undersized calloc allocation, and the
subsequent copy loop writes based on the actual (untruncated) key count,
resulting in a heap buffer overflow. A similar truncation may happen
in XkbResizeKeySyms() and XkbResizeKeyActions().
Widen the fields from unsigned short to unsigned int. These are internal
server structures, not wire protocol types.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-31834
CVE-2026-93518
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341 >
(cherry picked from commit 89101a6c66
2026-10-08 20:46:29 +02:00
include: misc.h: drop duplicate definition of CallbackListPtr
2025-09-25 09:36:53 +02:00
dix: unexport ResizeVisualArray()
2025-06-12 17:21:46 +02:00
dix: move SHAREDCOLOR struct declaration out of public header
2025-06-12 17:21:43 +02:00
include: unexport CURSOR_BITS_SIZE() and CURSOR_REC_SIZE() macros
2025-11-08 10:45:43 +01:00
include: move include guards up to wrap the whole file
2025-11-21 15:20:11 +01:00
include: dix.h: declare clients[] array prototype without size
2025-12-10 16:24:11 +01:00
dix: dixfonts: drop unused GetFontPath()
2025-11-20 19:26:32 +01:00
include: dixfontstr.h: drop unused PADGLYPHWIDTHBYTES defines
2025-11-07 09:32:40 +01:00
include: don't install client.h anymore
2025-12-05 19:44:59 +01:00
dix: unexport XIUnregisterPropertyHandler() and XIDeleteAllDeviceProperties()
2025-11-20 19:21:37 +01:00
include: update comment about exported noPanoramiXExtension
2025-09-15 10:26:11 +02:00
os: move X_NOTIFY_* defines to separate header
2025-07-25 15:21:13 +02:00
dix: move GCAllBits define into private header
2025-11-27 20:05:59 +01:00
include: globals.h: drop unnecessary includes
2025-11-27 12:06:53 +01:00
Xext/glx: exports symbols to make extension shared
2026-10-07 16:55:56 +02:00
Xi: unexport AssignTypeAndName()
2025-06-12 17:21:46 +02:00
include: list.h: add duplicate checking add/append functions
2025-06-12 17:21:48 +02:00
os/auth: prefer getrandom() over arc4random_buf() and /dev/urandom
2026-06-10 15:55:11 +02:00
os: add header for math related functions (possibly OS optimized)
2025-11-27 19:58:33 +01:00
dix: unexport enableIndirectGLX
2025-11-20 19:25:41 +01:00
os.h: fix _X_ATTRIBUTE_VPRINTF() macro on MacOS and FreeBSD
2025-12-10 15:02:00 +01:00
include: pixmapstr.h: inline PixmapBox() and fix signedness
2025-09-18 20:26:31 +02:00
dix: privates: update docs on dixRegisterPrivateKey()
2025-10-29 11:45:04 +01:00
include: move PropertyPtr from property.h to window.h
2025-11-20 19:23:05 +01:00
include: regionstr.h: drop unused legacy macros
2025-11-12 15:39:50 +01:00
dix: unexport ResourceStateCallback (not used by drivers)
2025-09-29 10:34:35 +02:00
include: tiny indention cleanup
2025-12-03 14:00:02 +01:00
dix: make BITMAP_SCANLINE_UNIT private
2025-11-27 12:05:55 +01:00
include: move include guards up to wrap the whole file
2025-11-21 15:20:11 +01:00
treewide: don't include <region.h> anymore
2025-11-27 19:27:27 +01:00
include: windowstr.h: unexport w*() macros
2025-11-27 19:54:42 +01:00
xkb: unexport XkbRF_VarDefsRec struct
2025-06-12 17:21:47 +02:00
Revert "xkb: unexport XkbGetCoreMap() and XkbSetRepeatKeys()"
2026-06-16 06:48:41 +02:00
xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int
2026-10-08 20:46:29 +02:00
include: fix warning on XNFvasprintf() prototype
2025-12-04 17:28:58 +01:00
Revert 9a82f5c, bring back Cygwin support.
2025-12-21 12:59:03 +01:00
4d6f715f77