File xkbcomp-Don-t-crash-on-no-op-modmask-expression... of Package libxkbcommon.31860

Overview Repositories Revisions Requests Users Attributes Meta

File xkbcomp-Don-t-crash-on-no-op-modmask-expressions.patch of Package libxkbcommon.31860

From 96df3106d49438e442510c59acad306e94f3db4d Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniels@collabora.com>
Date: Mon, 26 Jun 2017 17:12:29 +0100
Subject: [PATCH] xkbcomp: Don't crash on no-op modmask expressions
Git-commit: 96df3106d49438e442510c59acad306e94f3db4d
Patch-mainline: xkbcommon-0.8.2
References: CVE-2018-15863

If we have an expression of the form 'l1' in an interp section, we
unconditionally try to dereference its args, even if it has none.

Signed-off-by: Daniel Stone <daniels@collabora.com>

---
 src/xkbcomp/compat.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/xkbcomp/compat.c b/src/xkbcomp/compat.c
index 9ae26cd..bd587c8 100644
--- a/src/xkbcomp/compat.c
+++ b/src/xkbcomp/compat.c
@@ -264,7 +264,8 @@ ResolveStateAndPredicate(ExprDef *expr, enum xkb_match_operation *pred_rtrn,
     *pred_rtrn = MATCH_EXACTLY;
     if (expr->expr.op == EXPR_ACTION_DECL) {
         const char *pred_txt = xkb_atom_text(info->ctx, expr->action.name);
-        if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn)) {
+        if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn) ||
+            !expr->action.args) {
             log_err(info->ctx,
                     "Illegal modifier predicate \"%s\"; Ignored\n", pred_txt);
             return false;
-- 
2.35.3

Places

File xkbcomp-Don-t-crash-on-no-op-modmask-expressions.patch of Package libxkbcommon.31860

Places