You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
36 lines
1.1 KiB
36 lines
1.1 KiB
From 9c70f90b24ba5de5eeb8a854c25f72a38d497fb7 Mon Sep 17 00:00:00 2001 |
|
From: Peter Hutterer <peter.hutterer@who-t.net> |
|
Date: Mon, 5 Dec 2022 15:55:54 +1000 |
|
Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after |
|
freeing it |
|
|
|
Unlike other elements of the keymap, this pointer was freed but not |
|
reset. On a subsequent XkbGetKbdByName request, the server may access |
|
already freed memory. |
|
|
|
CVE-2022-46283, ZDI-CAN-19530 |
|
|
|
This vulnerability was discovered by: |
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative |
|
|
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> |
|
Acked-by: Olivier Fourdan <ofourdan@redhat.com> |
|
--- |
|
xkb/xkbUtils.c | 1 + |
|
1 file changed, 1 insertion(+) |
|
|
|
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c |
|
index dd089c2046..3f5791a183 100644 |
|
--- a/xkb/xkbUtils.c |
|
+++ b/xkb/xkbUtils.c |
|
@@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst) |
|
} |
|
else { |
|
free(dst->names->radio_groups); |
|
+ dst->names->radio_groups = NULL; |
|
} |
|
dst->names->num_rg = src->names->num_rg; |
|
|
|
-- |
|
2.38.1 |
|
|
|
|