xserver: Branch 'xwayland-21.1' - 5 commits

[GitLab Mirror]

 Xext/saver.c    |    2 +-
 meson.build     |    2 +-
 record/record.c |    4 ++--
 render/render.c |    9 +++++++++
 xfixes/cursor.c |    6 ++++--
 5 files changed, 17 insertions(+), 6 deletions(-)

New commits:
commit fbc03d7e486e8c1e33f0c2d3ff9ed415c95de166
Author: Olivier Fourdan <ofourdan at redhat.com>
Date:   Tue Dec 14 14:13:15 2021 +0100

    Bump version to 21.1.4
    
    Signed-off-by: Olivier Fourdan <ofourdan at redhat.com>

diff --git a/meson.build b/meson.build
index 6d73a34a4..2b7762e21 100644
--- a/meson.build
+++ b/meson.build
@@ -3,7 +3,7 @@ project('xwayland', 'c',
             'buildtype=debugoptimized',
             'c_std=gnu99',
         ],
-        version: '21.1.3',
+        version: '21.1.4',
         meson_version: '>= 0.46.0',
 )
 add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc'])
commit 59c977bff66de77bd93ce8853e33e1b4ca661a49
Author: Povilas Kanapickas <povilas at radix.lt>
Date:   Tue Dec 14 15:00:03 2021 +0200

    render: Fix out of bounds access in SProcRenderCompositeGlyphs()
    
    ZDI-CAN-14192, CVE-2021-4008
    
    This vulnerability was discovered and the fix was suggested by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
    (cherry picked from commit ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60)

diff --git a/render/render.c b/render/render.c
index c376090ca..456f156d4 100644
--- a/render/render.c
+++ b/render/render.c
@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client)
 
         i = elt->len;
         if (i == 0xff) {
+            if (buffer + 4 > end) {
+                return BadLength;
+            }
             swapl((int *) buffer);
             buffer += 4;
         }
@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client)
                 buffer += i;
                 break;
             case 2:
+                if (buffer + i * 2 > end) {
+                    return BadLength;
+                }
                 while (i--) {
                     swaps((short *) buffer);
                     buffer += 2;
                 }
                 break;
             case 4:
+                if (buffer + i * 4 > end) {
+                    return BadLength;
+                }
                 while (i--) {
                     swapl((int *) buffer);
                     buffer += 4;
commit fe0c050276c09f43cc1ae80b4553db42398ca84c
Author: Povilas Kanapickas <povilas at radix.lt>
Date:   Tue Dec 14 15:00:02 2021 +0200

    Xext: Fix out of bounds access in SProcScreenSaverSuspend()
    
    ZDI-CAN-14951, CVE-2021-4010
    
    This vulnerability was discovered and the fix was suggested by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
    (cherry picked from commit 6c4c53010772e3cb4cb8acd54950c8eec9c00d21)

diff --git a/Xext/saver.c b/Xext/saver.c
index 1d7e3cadf..f813ba08d 100644
--- a/Xext/saver.c
+++ b/Xext/saver.c
@@ -1351,8 +1351,8 @@ SProcScreenSaverSuspend(ClientPtr client)
     REQUEST(xScreenSaverSuspendReq);
 
     swaps(&stuff->length);
-    swapl(&stuff->suspend);
     REQUEST_SIZE_MATCH(xScreenSaverSuspendReq);
+    swapl(&stuff->suspend);
     return ProcScreenSaverSuspend(client);
 }
 
commit 3eb5445f6f7fa9f86de87adc768105d42bdbcf74
Author: Povilas Kanapickas <povilas at radix.lt>
Date:   Tue Dec 14 15:00:01 2021 +0200

    xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
    
    ZDI-CAN-14950, CVE-2021-4009
    
    This vulnerability was discovered and the fix was suggested by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
    (cherry picked from commit b5196750099ae6ae582e1f46bd0a6dad29550e02)

diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index 60580b88f..c5d4554b2 100644
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client)
 {
     REQUEST(xXFixesCreatePointerBarrierReq);
 
-    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
+    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
+                       pad_to_int32(stuff->num_devices * sizeof(CARD16)));
     LEGAL_NEW_RESOURCE(stuff->barrier, client);
 
     return XICreatePointerBarrier(client, stuff);
@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client)
 
     swaps(&stuff->length);
     swaps(&stuff->num_devices);
-    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
+    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
+                       pad_to_int32(stuff->num_devices * sizeof(CARD16)));
 
     swapl(&stuff->barrier);
     swapl(&stuff->window);
commit a8644465d98beb08759546711b77bb617861c67f
Author: Povilas Kanapickas <povilas at radix.lt>
Date:   Tue Dec 14 15:00:00 2021 +0200

    record: Fix out of bounds access in SwapCreateRegister()
    
    ZDI-CAN-14952, CVE-2021-4011
    
    This vulnerability was discovered and the fix was suggested by:
    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
    
    Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
    (cherry picked from commit e56f61c79fc3cee26d83cda0f84ae56d5979f768)

diff --git a/record/record.c b/record/record.c
index be154525d..e123867a7 100644
--- a/record/record.c
+++ b/record/record.c
@@ -2516,8 +2516,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff)
         swapl(pClientID);
     }
     if (stuff->nRanges >
-        client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
-        - stuff->nClients)
+        (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
+        - stuff->nClients) / bytes_to_int32(sz_xRecordRange))
         return BadLength;
     RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);
     return Success;