hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-15 05:23:40 +00:00
Code Issues Projects Releases Wiki Activity
xserver/Xext/xinput
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer a8192aa709 Xi: add bounds check for barrier events in input_constrain_cursor 
input_constrain_cursor() writes barrier hit and leave events into the
InputEventList buffer without checking how many slots remain.
The buffer is allocated by the DDX at GetMaximumEventsNum() (100) entries
and may contain one raw event already. A client can create more than 100
pointer barriers, pre-arm them as released via XIBarrierReleasePointer,
and then trigger a single pointer motion that crosses all barriers
simultaneously. The leave event loop iterates every hit barrier and
writes one event per barrier, overflowing the 100-slot buffer.

In an ideal world we'd change the InternalEvent* pointer to a struct
that contains allocated size, number of events and the pointer itself
but we're crossing public APIs here and that requires an ABI bump.

So we make do with cutting off the number of barrier events at 64 which
should be low enough to not trigger the issue. However, for the 100+
barrier case this means we only send BarierHit events, not BarrierRelease.
Potentially leaving a client stuck.

We mitigate that problem by simply refusing to create more than 32
barriers per screen (which on its own would also fix the issue, but hey,
'doppelt gemoppelt' as they say).

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-31938

CVE-2026-93519

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit 1f42cc1f00)
2026-10-20 21:11:11 +02:00
..
allowev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgdctl.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgfctl.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgkbd.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgkmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgprop.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgptr.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgptr.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
closedev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
devbell.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
exevents.c Xi: Guard against NULL event pointer 2026-08-31 14:47:14 +02:00
exglobals.h Xi: turn XIAllMasks from variable into #define 2026-06-29 14:30:53 +02:00
extinit.c Xi: byte-swap DeviceChanged valuator and scroll data 2026-10-01 19:00:26 +02:00
getbmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getdctl.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getfctl.c Xi: zero feedback reply buffer in ProcXGetFeedbackControl 2026-06-23 17:28:08 +02:00
getfocus.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getkmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getmmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getprop.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getprop.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getselev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getvers.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
grabdev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
grabdev.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
grabdevb.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
grabdevk.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
gtmotion.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
handlers.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
listdev.c xext: xinput: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:25:28 +02:00
meson.build Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
opendev.c Xi: parentheses around macro argument symbols 2026-06-25 07:31:44 +02:00
queryst.c Xi: fix NULL pointer dereference in ProcXQueryDeviceState 2026-06-23 17:28:42 +02:00
selectev.c Xi: turn XIAllMasks from variable into #define 2026-06-29 14:30:53 +02:00
sendexev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setbmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setdval.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setfocus.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setmmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setmode.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
stubs.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
ungrdev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
ungrdevb.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
ungrdevk.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xiallowev.c xext: xinput: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:25:28 +02:00
xibarriers.c Xi: add bounds check for barrier events in input_constrain_cursor 2026-10-20 21:11:11 +02:00
xibarriers.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xichangecursor.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xichangehierarchy.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xichangehierarchy.h treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xigetclientpointer.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xigrabdev.c treewide: replace min/max macros by non-exported MIN/MAX and deprecate them 2026-06-25 14:06:17 +02:00
xipassivegrab.c Xi: validate modifier values in ProcXIPassiveUngrabDevice 2026-10-20 21:11:11 +02:00
xiproperty.c xext: xinput: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:25:28 +02:00
xiproperty.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xiquerydevice.c Xi: byte-swap XIQueryDevice ScrollClass flags 2026-10-01 18:55:18 +02:00
xiquerydevice.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xiquerypointer.c xext: xinput: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:25:28 +02:00
xiqueryversion.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xiselectev.c Xi: xiselectev: fix OOB read in ProcXISelectEvents' non-swapped path 2026-07-03 19:59:53 +02:00
xisetclientpointer.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xisetdevfocus.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
XIstubs.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xiwarppointer.c dix, Xi: remove spurious dereference when checking function pointers 2026-10-15 16:47:45 +02:00