|
| 1 | +From 0885e0b26225c90534642fe911632ec0779eebee Mon Sep 17 00:00:00 2001 |
| 2 | +From: Olivier Fourdan < [email protected]> |
| 3 | +Date: Fri, 28 Mar 2025 09:43:52 +0100 |
| 4 | +Subject: [PATCH] render: Avoid 0 or less animated cursors |
| 5 | +MIME-Version: 1.0 |
| 6 | +Content-Type: text/plain; charset=UTF-8 |
| 7 | +Content-Transfer-Encoding: 8bit |
| 8 | + |
| 9 | +Upstream Patch Link: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0885e0b26225c90534642fe911632ec0779eebee.patch |
| 10 | + |
| 11 | +Animated cursors use a series of cursors that the client can set. |
| 12 | + |
| 13 | +By default, the Xserver assumes at least one cursor is specified |
| 14 | +while a client may actually pass no cursor at all. |
| 15 | + |
| 16 | +That causes an out-of-bound read creating the animated cursor and a |
| 17 | +crash of the Xserver: |
| 18 | + |
| 19 | + | Invalid read of size 8 |
| 20 | + | at 0x5323F4: AnimCursorCreate (animcur.c:325) |
| 21 | + | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) |
| 22 | + | by 0x52DC80: ProcRenderDispatch (render.c:1999) |
| 23 | + | by 0x4A1E9D: Dispatch (dispatch.c:560) |
| 24 | + | by 0x4B0169: dix_main (main.c:284) |
| 25 | + | by 0x4287F5: main (stubmain.c:34) |
| 26 | + | Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd |
| 27 | + | at 0x48468D3: reallocarray (vg_replace_malloc.c:1803) |
| 28 | + | by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802) |
| 29 | + | by 0x52DC80: ProcRenderDispatch (render.c:1999) |
| 30 | + | by 0x4A1E9D: Dispatch (dispatch.c:560) |
| 31 | + | by 0x4B0169: dix_main (main.c:284) |
| 32 | + | by 0x4287F5: main (stubmain.c:34) |
| 33 | + | |
| 34 | + | Invalid read of size 2 |
| 35 | + | at 0x5323F7: AnimCursorCreate (animcur.c:325) |
| 36 | + | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) |
| 37 | + | by 0x52DC80: ProcRenderDispatch (render.c:1999) |
| 38 | + | by 0x4A1E9D: Dispatch (dispatch.c:560) |
| 39 | + | by 0x4B0169: dix_main (main.c:284) |
| 40 | + | by 0x4287F5: main (stubmain.c:34) |
| 41 | + | Address 0x8 is not stack'd, malloc'd or (recently) free'd |
| 42 | + |
| 43 | +To avoid the issue, check the number of cursors specified and return a |
| 44 | +BadValue error in both the proc handler (early) and the animated cursor |
| 45 | +creation (as this is a public function) if there is 0 or less cursor. |
| 46 | + |
| 47 | +CVE-2025-49175 |
| 48 | + |
| 49 | +This issue was discovered by Nils Emmerich < [email protected]> and |
| 50 | +reported by Julian Suleder via ERNW Vulnerability Disclosure. |
| 51 | + |
| 52 | +Signed-off-by: Olivier Fourdan < [email protected]> |
| 53 | +Reviewed-by: José Expósito < [email protected]> |
| 54 | +Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024> |
| 55 | +--- |
| 56 | + render/animcur.c | 3 +++ |
| 57 | + render/render.c | 2 ++ |
| 58 | + 2 files changed, 5 insertions(+) |
| 59 | + |
| 60 | +diff --git a/render/animcur.c b/render/animcur.c |
| 61 | +index f906cd8130..1194cee7e7 100644 |
| 62 | +--- a/render/animcur.c |
| 63 | ++++ b/render/animcur.c |
| 64 | +@@ -305,6 +305,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor, |
| 65 | + int rc = BadAlloc, i; |
| 66 | + AnimCurPtr ac; |
| 67 | + |
| 68 | ++ if (ncursor <= 0) |
| 69 | ++ return BadValue; |
| 70 | ++ |
| 71 | + for (i = 0; i < screenInfo.numScreens; i++) |
| 72 | + if (!GetAnimCurScreen(screenInfo.screens[i])) |
| 73 | + return BadImplementation; |
| 74 | +diff --git a/render/render.c b/render/render.c |
| 75 | +index 113f6e0c5a..fe9f03c8c8 100644 |
| 76 | +--- a/render/render.c |
| 77 | ++++ b/render/render.c |
| 78 | +@@ -1799,6 +1799,8 @@ ProcRenderCreateAnimCursor(ClientPtr client) |
| 79 | + ncursor = |
| 80 | + (client->req_len - |
| 81 | + (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1; |
| 82 | ++ if (ncursor <= 0) |
| 83 | ++ return BadValue; |
| 84 | + cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32)); |
| 85 | + if (!cursors) |
| 86 | + return BadAlloc; |
| 87 | +-- |
| 88 | +GitLab |
| 89 | + |
0 commit comments