From ba336b24052122b136486961c82deac76bbde455 Mon Sep 17 00:00:00 2001 From: Michal Srb Date: Wed, 24 May 2017 15:54:42 +0300 Subject: [PATCH] Xi: Do not try to swap GenericEvent. The SProcXSendExtensionEvent must not attempt to swap GenericEvent because it is assuming that the event has fixed size and gives the swapping function xEvent-sized buffer. A GenericEvent would be later rejected by ProcXSendExtensionEvent anyway. Signed-off-by: Michal Srb Reviewed-by: Peter Hutterer Signed-off-by: Peter Hutterer CVE: CVE-2017-10971 Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455] Signed-off-by: Jackie Huang --- Xi/sendexev.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/Xi/sendexev.c b/Xi/sendexev.c index 5e63bfc..5c2e0fc 100644 --- a/Xi/sendexev.c +++ b/Xi/sendexev.c @@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client) eventP = (xEvent *) &stuff[1]; for (i = 0; i < stuff->num_events; i++, eventP++) { + if (eventP->u.u.type == GenericEvent) { + client->errorValue = eventP->u.u.type; + return BadValue; + } + proc = EventSwapVector[eventP->u.u.type & 0177]; - if (proc == NotImplemented) /* no swapping proc; invalid event type? */ + /* no swapping proc; invalid event type? */ + if (proc == NotImplemented) { + client->errorValue = eventP->u.u.type; return BadValue; + } (*proc) (eventP, &eventT); *eventP = eventT; } -- 1.7.9.5