File U_CVE-2025-49175-render-Avoid-0-or-less-animated-cursors.patch of Package xorg-x11-server

From 8c5f521c0492941794301afe107a2ee5030128af Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <ofourdan@redhat.com>
Date: Fri, 28 Mar 2025 09:43:52 +0100
Subject: [PATCH xserver] render: Avoid 0 or less animated cursors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Animated cursors use a series of cursors that the client can set.

By default, the Xserver assumes at least one cursor is specified
while a client may actually pass no cursor at all.

That causes an out-of-bound read creating the animated cursor and a
crash of the Xserver:

 | Invalid read of size 8
 |    at 0x5323F4: AnimCursorCreate (animcur.c:325)
 |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |  Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd
 |    at 0x48468D3: reallocarray (vg_replace_malloc.c:1803)
 |    by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |
 | Invalid read of size 2
 |    at 0x5323F7: AnimCursorCreate (animcur.c:325)
 |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |  Address 0x8 is not stack'd, malloc'd or (recently) free'd

To avoid the issue, check the number of cursors specified and return a
BadValue error in both the proc handler (early) and the animated cursor
creation (as this is a public function) if there is 0 or less cursor.

CVE-2025-49175

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: José Expósito <jexposit@redhat.com>
---
 render/animcur.c | 3 +++
 render/render.c  | 2 ++
 2 files changed, 5 insertions(+)

Index: xorg-server-21.1.15/render/animcur.c
===================================================================
--- xorg-server-21.1.15.orig/render/animcur.c
+++ xorg-server-21.1.15/render/animcur.c
@@ -304,6 +304,9 @@ AnimCursorCreate(CursorPtr *cursors, CAR
     int rc = BadAlloc, i;
     AnimCurPtr ac;
 
+    if (ncursor <= 0)
+        return BadValue;
+
     for (i = 0; i < screenInfo.numScreens; i++)
         if (!GetAnimCurScreen(screenInfo.screens[i]))
             return BadImplementation;
Index: xorg-server-21.1.15/render/render.c
===================================================================
--- xorg-server-21.1.15.orig/render/render.c
+++ xorg-server-21.1.15/render/render.c
@@ -1795,6 +1795,8 @@ ProcRenderCreateAnimCursor(ClientPtr cli
     ncursor =
         (client->req_len -
          (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1;
+    if (ncursor <= 0)
+        return BadValue;
     cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32));
     if (!cursors)
         return BadAlloc;