[xsrc/trunk]: xsrc/external/mit/xorg-server.old/dist/Xi pullover fix from xor...

[mrg <mrg%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/xsrc/rev/c0d369646859
branches:  trunk
changeset: 7418:c0d369646859
user:      mrg <mrg%NetBSD.org@localhost>
date:      Tue Feb 07 07:29:44 2023 +0000

description:
pullover fix from xorg-server 21.1.7:

https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec

Xi: fix potential use-after-free in DeepCopyPointerClasses

CVE-2023-0494, ZDI-CAN-19596

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer's avatarPeter Hutterer <peter.hutterer%who-t.net@localhost>

diffstat:

 external/mit/xorg-server.old/dist/Xi/exevents.c |  4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diffs (15 lines):

diff -r 1165329fbabb -r c0d369646859 external/mit/xorg-server.old/dist/Xi/exevents.c
--- a/external/mit/xorg-server.old/dist/Xi/exevents.c   Tue Feb 07 05:05:51 2023 +0000
+++ b/external/mit/xorg-server.old/dist/Xi/exevents.c   Tue Feb 07 07:29:44 2023 +0000
@@ -586,8 +586,10 @@
             }
             memcpy(to->button->xkb_acts, from->button->xkb_acts,
                     sizeof(XkbAction));
-        } else
+        } else {
             free(to->button->xkb_acts);
+            to->button->xkb_acts = NULL;
+       }
 
          memcpy(to->button->labels, from->button->labels,
                 from->button->numButtons * sizeof(Atom));