CVS commit: xsrc/external/mit/xorg-server.old/dist/Xi

["matthew green" <mrg%netbsd.org@localhost>]

Module Name:    xsrc
Committed By:   mrg
Date:           Sat Nov  2 23:46:50 UTC 2024

Modified Files:
        xsrc/external/mit/xorg-server.old/dist/Xi: exevents.c

Log Message:
merge upstream change ece23be888a93b741aa1209d1dbf64636109d6a5 but into
Xi/exevents.c instead of dix/enterleave.c.

Subject: [PATCH] dix: Allocate sufficient xEvents for our DeviceStateNotify

If a device has both a button class and a key class and numButtons is
zero, we can get an OOB write due to event under-allocation.

This function seems to assume a device has either keys or buttons, not
both. It has two virtually identical code paths, both of which assume
they're applying to the first event in the sequence.

A device with both a key and button class triggered a logic bug - only
one xEvent was allocated but the deviceStateNotify pointer was pushed on
once per type. So effectively this logic code:

   int count = 1;
   if (button && nbuttons > 32) count++;
   if (key && nbuttons > 0) count++;
   if (key && nkeys > 32) count++; // this is basically always true
   // count is at 2 for our keys + zero button device

   ev = alloc(count * sizeof(xEvent));
   FixDeviceStateNotify(ev);
   if (button)
     FixDeviceStateNotify(ev++);
   if (key)
     FixDeviceStateNotify(ev++);   // santa drops into the wrong chimney here

If the device has more than 3 valuators, the OOB is pushed back - we're
off by one so it will happen when the last deviceValuator event is
written instead.

Fix this by allocating the maximum number of events we may allocate.
Note that the current behavior is not protocol-correct anyway, this
patch fixes only the allocation issue.

Note that this issue does not trigger if the device has at least one
button. While the server does not prevent a button class with zero
buttons, it is very unlikely.

CVE-2024-0229, ZDI-CAN-22678

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative


To generate a diff of this commit:
cvs rdiff -u -r1.3 -r1.4 xsrc/external/mit/xorg-server.old/dist/Xi/exevents.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.