diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2022-12-05 15:55:54 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2022-12-14 11:24:47 +1000 |
| commit | e860bbce4fdb169e84033529331ae2666e679de7 (patch) | |
| tree | 5abbd1b3e5ee2863f89ca5b911b1a6e33dd3f094 | |
| parent | 8a1fa008b2f90abce6cabb27d9bc2ed76d07b678 (diff) | |
| download | xserver-e860bbce4fdb169e84033529331ae2666e679de7.tar.gz | |
xkb: reset the radio_groups pointer to NULL after freeing it
Unlike other elements of the keymap, this pointer was freed but not
reset. On a subsequent XkbGetKbdByName request, the server may access
already freed memory.
CVE-2022-4283, ZDI-CAN-19530
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit ccdd431cd8f1cabae9d744f0514b6533c438908c)
| -rw-r--r-- | xkb/xkbUtils.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c index 8975ade8d..9bc51fc71 100644 --- a/xkb/xkbUtils.c +++ b/xkb/xkbUtils.c @@ -1327,6 +1327,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst) } else { free(dst->names->radio_groups); + dst->names->radio_groups = NULL; } dst->names->num_rg = src->names->num_rg; |