Exact

Exact Union RegExp

Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Enrico Weigelt, metux IT consult 24ca991030 Xext: xtest: fix stack out-of-bounds write in ProcXTestFakeInput ... ProcXTestFakeInput() copies attacker-controlled valuator values into the fixed-size on-stack array int valuators[MAX_VALUATORS] (MAX_VALUATORS == 36) when faking an XI DeviceMotionNotify event. Two flaws allowed a write past the end of that array: * The initial check used "firstValuator > dev->valuator->numAxes", so firstValuator == numAxes (legitimately up to 36) was accepted, leaving base == 36 at the start of the first iteration. * The per-valuator range check "firstValuator + numValuators > dev->valuator->numAxes" was performed *after* the switch that already wrote valuators[base .. base + 5], so the out-of-bounds write happened before the request was rejected with BadValue. A client controlling an XI device with numAxes == 36 could therefore send a DeviceValuator with first_valuator == 36 and num_valuators in 1..6 and write up to six attacker-controlled INT32s past the end of the stack buffer. Tighten the initial check to ">=" and validate num_valuators and the axis range *before* writing the valuators. Fixes: 105d28652d ("Xext: use GPE/GKE from XTestFakeInput #16145") Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>		2026-06-12 18:58:56 +02:00
..
namespace
bigreq.c
dpms.c
dpmsproc.h
geext.c
geext_priv.h
hashtable.c
hashtable.h
meson.build
panoramiX.c
panoramiX.h
panoramiXh.h
panoramiXprocs.c
panoramiXsrv.h
panoramiXSwap.c
saver.c
security.c
securitysrv.h
shape.c
shm.c
shmint.h
sleepuntil.c
sleepuntil.h
sync.c
syncsdk.h
syncsrv.h
vidmode.c
xace.c
xace.h
xacestr.h
xcmisc.c
xf86bigfont.c
xf86bigfontsrv.h
xres.c
xselinux.h
xselinux_ext.c
xselinux_hooks.c
xselinux_label.c
xselinuxint.h
xtest.c	Xext: xtest: fix stack out-of-bounds write in ProcXTestFakeInput	2026-06-12 18:58:56 +02:00
xvdisp.c
xvdisp.h
xvdix.h
xvdix_priv.h
xvmain.c
xvmc.c
xvmcext.h