mirror of
https://github.com/X11Libre/xserver.git
synced 2026-11-14 05:14:45 +00:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
bae088ccbd
CheckKeySyms() has two loops: the first processes keys in the SetMap
request range, the second fills in any missing keys from the existing
map.
The indexing between the two was inconsistent: the first loop
uses a zero-based index + req->firstKeySym, the second loop used it just
as zero-based index.
Example:
req->firstKeySym = 50
req->nKeySyms = 10
i goes from 0 to 10,
loop 1 checks [50, 60), changes the width but finishes with i at 10.
loop 2 then runs over [10, 255(, copying the old keymap width
The second loop overwrites the new widths with the width of the
existing keymap. The subsequent SetKeySyms worked on the new width
and may write fewer actions than the map width.
A subsequent XkbGetMap request would then read XkbKeyNumActions()
entries (derived from the new wider key_sym_map.width) from the shorter
action allocation, causing an out-of-bounds heap read. The overread
bytes would be copied into the GetMap reply and sent back to the client,
producing a bounded heap information disclosure.
This vulnerability was discovered by:
WONJOON HWANG (@joon1337) working with TrendAI Zero Day Initiative
ZDI-CAN-32408
CVE-2026-93524
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit
|
||
| .. | ||
| bigreq | ||
| bugs | ||
| damage | ||
| info | ||
| pyxtest | ||
| scripts | ||
| sync | ||
| xi1 | ||
| xi2 | ||
| .gitignore | ||
| ddc-tests.c | ||
| fixes.c | ||
| hashtabletest.c | ||
| input.c | ||
| list.c | ||
| list_zeroinit.c | ||
| meson.build | ||
| misc.c | ||
| README | ||
| sha1.c | ||
| signal-logging.c | ||
| simple-xinit.c | ||
| string.c | ||
| test_xkb.c | ||
| tests-common.c | ||
| tests-common.h | ||
| tests.c | ||
| tests.h | ||
| touch.c | ||
| xfree86.c | ||
| xtest.c | ||
X server test suite This suite contains a set of tests to verify the behaviour of functions used internally to the server. = How it works = Through some automake abuse, we link the test programs with the same static libraries as the Xorg binary. The test suites can then call various functions and verify their behaviour - without the need to start the server or connect clients. This testing only works for functions that do not rely on a particular state of the X server. Unless the test suite replicates the expected state, which may be difficult. = How to run the tests = Run "make check" in the test directory. This will compile the tests and execute them in the order specified in the TESTS variable in test/Makefile.am. Each set of tests related to a subsystem are available as a binary that can be executed directly. For example, run "xkb" to perform some xkb-related tests. == Adding a new test == When adding a new test, ensure that you add a short description of what the test does and what the expected outcome is.