mirror of
https://github.com/X11Libre/xserver.git
synced 2026-11-14 05:14:45 +00:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
02359bf013
__glXDisp_RenderLarge() allocates the large command buffer based on
cmdlen (from hdr->length, the total command size embedded in the
payload), but copies dataBytes (from req->dataBytes, the payload size
of the current sub-request) into it. The existing length check only
validates that the X11 request length is consistent with dataBytes,
not that dataBytes fits within the cmdlen-sized buffer.
A malicious client can set hdr->length to a small value (e.g. 12 bytes)
while sending a large dataBytes (up to ~256KB or more with
BIG-REQUESTS), causing the memcpy to overflow the cmdlen-sized buffer.
Add a check that dataBytes <= cmdlen before the buffer allocation and
copy on the first request.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-31833
CVE-2026-93517
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit
|
||
| .. | ||
| glx_dri | ||
| clientinfo.c | ||
| createcontext.c | ||
| extension_string.c | ||
| extension_string.h | ||
| glxcmds.c | ||
| glxcmdsswap.c | ||
| glxcontext.h | ||
| glxdrawable.h | ||
| glxext.c | ||
| glxext.h | ||
| glxscreens.c | ||
| glxscreens.h | ||
| glxserver.h | ||
| glxutil.h | ||
| indirect_dispatch.c | ||
| indirect_dispatch.h | ||
| indirect_dispatch_swap.c | ||
| indirect_program.c | ||
| indirect_reqsize.c | ||
| indirect_reqsize.h | ||
| indirect_size.h | ||
| indirect_size_get.c | ||
| indirect_size_get.h | ||
| indirect_table.c | ||
| indirect_table.h | ||
| indirect_texture_compression.c | ||
| indirect_util.c | ||
| indirect_util.h | ||
| meson.build | ||
| render2.c | ||
| render2swap.c | ||
| renderpix.c | ||
| renderpixswap.c | ||
| rensize.c | ||
| single2.c | ||
| single2swap.c | ||
| singlepix.c | ||
| singlepixswap.c | ||
| singlesize.c | ||
| singlesize.h | ||
| swap_interval.c | ||
| unpack.h | ||
| vnd_dispatch_stubs.c | ||
| vndcmds.c | ||
| vndext.c | ||
| vndserver_priv.h | ||
| vndservermapping.c | ||
| vndservervendor.c | ||
| vndservervendor.h | ||
| xfont.c | ||