File U_Xi-Verify-all-events-in-ProcXSendExtensionEve... of Package xorg-x11-server

Overview Repositories Revisions Requests Users Attributes Meta

File U_Xi-Verify-all-events-in-ProcXSendExtensionEvent.patch of Package xorg-x11-server

Author: Michal Srb <msrb@suse.com>
Subject: Xi: Verify all events in ProcXSendExtensionEvent.
Git-commit: 8caed4df36b1f802b4992edcfd282cbeeec35d9d
Patch-mainline: Upstream
References: bnc#1035283 CVE-2017-10971

The requirement is that events have type in range
EXTENSION_EVENT_BASE..lastEvent, but it was tested
only for first event of all.

Signed-off-by: Michal Srb <msrb@suse.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 Xi/sendexev.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index 1cf118ab6..5e63bfcca 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -117,7 +117,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 int
 ProcXSendExtensionEvent(ClientPtr client)
 {
-    int ret;
+    int ret, i;
     DeviceIntPtr dev;
     xEvent *first;
     XEventClass *list;
@@ -141,10 +141,12 @@ ProcXSendExtensionEvent(ClientPtr client)
     /* The client's event type must be one defined by an extension. */
 
     first = ((xEvent *) &stuff[1]);
-    if (!((EXTENSION_EVENT_BASE <= first->u.u.type) &&
-          (first->u.u.type < lastEvent))) {
-        client->errorValue = first->u.u.type;
-        return BadValue;
+    for (i = 0; i < stuff->num_events; i++) {
+        if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) &&
+            (first[i].u.u.type < lastEvent))) {
+            client->errorValue = first[i].u.u.type;
+            return BadValue;
+        }
     }
 
     list = (XEventClass *) (first + stuff->num_events);
-- 
2.12.0

Places

File U_Xi-Verify-all-events-in-ProcXSendExtensionEvent.patch of Package xorg-x11-server

Places