diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2022-12-05 15:55:54 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2022-12-14 11:02:40 +1000 |
| commit | ccdd431cd8f1cabae9d744f0514b6533c438908c (patch) | |
| tree | 8a3b0cfff90573f80321a510c11c76fb71cb9978 /xkb | |
| parent | 8f454b793e1f13c99872c15f0eed1d7f3b823fe8 (diff) | |
| download | xserver-ccdd431cd8f1cabae9d744f0514b6533c438908c.tar.gz | |
xkb: reset the radio_groups pointer to NULL after freeing it
Unlike other elements of the keymap, this pointer was freed but not
reset. On a subsequent XkbGetKbdByName request, the server may access
already freed memory.
CVE-2022-4283, ZDI-CAN-19530
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
Diffstat (limited to 'xkb')
| -rw-r--r-- | xkb/xkbUtils.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c index dd089c204..3f5791a18 100644 --- a/xkb/xkbUtils.c +++ b/xkb/xkbUtils.c @@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst) } else { free(dst->names->radio_groups); + dst->names->radio_groups = NULL; } dst->names->num_rg = src->names->num_rg; |