xserver: Branch 'server-1.20-branch' - 5 commits
GitLab Mirror
gitlab-mirror at kemper.freedesktop.org
Wed Dec 15 18:50:45 UTC 2021
Xext/saver.c | 2 +-
configure.ac | 4 ++--
meson.build | 2 +-
record/record.c | 4 ++--
render/render.c | 9 +++++++++
xfixes/cursor.c | 6 ++++--
6 files changed, 19 insertions(+), 8 deletions(-)
New commits:
commit 97c5b77774595c4dcef07223cd2684fea5201d5e
Author: Matt Turner <mattst88 at gmail.com>
Date: Wed Dec 15 13:34:48 2021 -0500
xserver 1.20.14
Signed-off-by: Matt Turner <mattst88 at gmail.com>
diff --git a/configure.ac b/configure.ac
index 2d21958de..0909cc5b4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
dnl Process this file with autoconf to create configure.
AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.20.13, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
-RELEASE_DATE="2021-07-29"
+AC_INIT([xorg-server], 1.20.14, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
+RELEASE_DATE="2021-12-15"
RELEASE_NAME="Lemon Pepper Chicken"
AC_CONFIG_SRCDIR([Makefile.am])
AC_CONFIG_MACRO_DIR([m4])
diff --git a/meson.build b/meson.build
index 26c83945d..ea45ca3d3 100644
--- a/meson.build
+++ b/meson.build
@@ -3,7 +3,7 @@ project('xserver', 'c',
'buildtype=debugoptimized',
'c_std=gnu99',
],
- version: '1.20.13',
+ version: '1.20.14',
meson_version: '>= 0.42.0',
)
add_project_arguments('-DHAVE_DIX_CONFIG_H', language: 'c')
commit 35b4681c79480d980bd8dcba390146aad7817c47
Author: Povilas Kanapickas <povilas at radix.lt>
Date: Tue Dec 14 15:00:03 2021 +0200
render: Fix out of bounds access in SProcRenderCompositeGlyphs()
ZDI-CAN-14192, CVE-2021-4008
This vulnerability was discovered and the fix was suggested by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
(cherry picked from commit ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60)
diff --git a/render/render.c b/render/render.c
index c376090ca..456f156d4 100644
--- a/render/render.c
+++ b/render/render.c
@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client)
i = elt->len;
if (i == 0xff) {
+ if (buffer + 4 > end) {
+ return BadLength;
+ }
swapl((int *) buffer);
buffer += 4;
}
@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client)
buffer += i;
break;
case 2:
+ if (buffer + i * 2 > end) {
+ return BadLength;
+ }
while (i--) {
swaps((short *) buffer);
buffer += 2;
}
break;
case 4:
+ if (buffer + i * 4 > end) {
+ return BadLength;
+ }
while (i--) {
swapl((int *) buffer);
buffer += 4;
commit 67425fcab50ef24a5617e109897f38876dd81277
Author: Povilas Kanapickas <povilas at radix.lt>
Date: Tue Dec 14 15:00:02 2021 +0200
Xext: Fix out of bounds access in SProcScreenSaverSuspend()
ZDI-CAN-14951, CVE-2021-4010
This vulnerability was discovered and the fix was suggested by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
(cherry picked from commit 6c4c53010772e3cb4cb8acd54950c8eec9c00d21)
diff --git a/Xext/saver.c b/Xext/saver.c
index c27a66c80..c23907dbb 100644
--- a/Xext/saver.c
+++ b/Xext/saver.c
@@ -1351,8 +1351,8 @@ SProcScreenSaverSuspend(ClientPtr client)
REQUEST(xScreenSaverSuspendReq);
swaps(&stuff->length);
- swapl(&stuff->suspend);
REQUEST_SIZE_MATCH(xScreenSaverSuspendReq);
+ swapl(&stuff->suspend);
return ProcScreenSaverSuspend(client);
}
commit 6bb8aeb30a2686facc48733016caade97ece10ad
Author: Povilas Kanapickas <povilas at radix.lt>
Date: Tue Dec 14 15:00:01 2021 +0200
xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
ZDI-CAN-14950, CVE-2021-4009
This vulnerability was discovered and the fix was suggested by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
(cherry picked from commit b5196750099ae6ae582e1f46bd0a6dad29550e02)
diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index d4b68f3af..5f531a89a 100644
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client)
{
REQUEST(xXFixesCreatePointerBarrierReq);
- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
+ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
+ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
LEGAL_NEW_RESOURCE(stuff->barrier, client);
return XICreatePointerBarrier(client, stuff);
@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client)
swaps(&stuff->length);
swaps(&stuff->num_devices);
- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
+ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
+ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
swapl(&stuff->barrier);
swapl(&stuff->window);
commit acc50e6097d51fec0c6c34d84c35018a50c52d5a
Author: Povilas Kanapickas <povilas at radix.lt>
Date: Tue Dec 14 15:00:00 2021 +0200
record: Fix out of bounds access in SwapCreateRegister()
ZDI-CAN-14952, CVE-2021-4011
This vulnerability was discovered and the fix was suggested by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
(cherry picked from commit e56f61c79fc3cee26d83cda0f84ae56d5979f768)
diff --git a/record/record.c b/record/record.c
index 05d751ac2..a8aec23bd 100644
--- a/record/record.c
+++ b/record/record.c
@@ -2515,8 +2515,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff)
swapl(pClientID);
}
if (stuff->nRanges >
- client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
- - stuff->nClients)
+ (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
+ - stuff->nClients) / bytes_to_int32(sz_xRecordRange))
return BadLength;
RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);
return Success;
More information about the xorg-commit
mailing list