[PATCH] xkb: Don't swap XkbSetGeometry data in the input buffer

Julien Cristau jcristau at debian.org
Mon Feb 9 02:21:31 PST 2015


On Fri, Jan 30, 2015 at 13:15:37 +1000, Peter Hutterer wrote:

> On Fri, Jan 16, 2015 at 08:08:59PM +0100, Olivier Fourdan wrote:
> > The XkbSetGeometry request embeds data which needs to be swapped when the
> > server and the client have different endianess.
> > 
> > _XkbSetGeometry() invokes functions that swap these data directly in the
> > input buffer.
> > 
> > However, ProcXkbSetGeometry() may call _XkbSetGeometry() more than once
> > (if there is more than one keyboard), thus causing on swapped clients the
> > same data to be swapped twice in memory, further causing a server crash
> > because the strings lengths on the second time are way off bounds.
> > 
> > To allow _XkbSetGeometry() to run reliably more than once with swapped
> > clients, do not swap the data in the buffer, use variables instead.
> > 
> > Signed-off-by: Olivier Fourdan <ofourdan at redhat.com>
> 
> Keith, please merge this one directly, thanks.
> 
Ping?

Cheers,
Julien


More information about the xorg-devel mailing list