File 0001-xkbcomp-Don-t-crash-on-no-op-modmask-expressions.patch of Package xkbcomp.41931
From fa10dbc2ca8bcb45bcecb433520de755e628ca91 Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniels@collabora.com>
Date: Mon, 26 Jun 2017 17:12:29 +0100
Subject: [PATCH 1/5] xkbcomp: Don't crash on no-op modmask expressions
If we have an expression of the form 'l1' in an interp section, we
unconditionally try to dereference its args, even if it has none.
CVE-2018-15863
Identical to libxkbcommon commit 96df3106d49438e442510c59acad306e94f3db4d
https://github.com/xkbcommon/libxkbcommon/commit/96df3106d49438e442510c59acad306e94f3db4d
Part-of: <https://gitlab.freedesktop.org/xorg/app/xkbcomp/-/merge_requests/38>
---
compat.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Index: xkbcomp-1.4.1/compat.c
===================================================================
--- xkbcomp-1.4.1.orig/compat.c
+++ xkbcomp-1.4.1/compat.c
@@ -307,6 +307,8 @@ ResolveStateAndPredicate(ExprDef * expr,
{
char *pred_txt =
XkbAtomText(NULL, expr->value.action.name, XkbMessage);
+ if (!pred_txt || !expr->value.action.args)
+ goto leave;
if (uStrCaseCmp(pred_txt, "noneof") == 0)
*pred_rtrn = XkbSI_NoneOf;
else if (uStrCaseCmp(pred_txt, "anyofornone") == 0)
@@ -319,7 +321,8 @@ ResolveStateAndPredicate(ExprDef * expr,
*pred_rtrn = XkbSI_Exactly;
else
{
- ERROR1("Illegal modifier predicate \"%s\"\n", pred_txt);
+leave: ERROR1("Illegal modifier predicate \"%s\"\n",
+ (pred_txt ? pred_txt : "(none)"));
ACTION("Ignored\n");
return False;
}