diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2022-12-05 15:55:54 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2022-12-14 12:43:42 +1000 |
| commit | 779f9cfa9977a87b1d8645d1ac1bdc6becaa583a (patch) | |
| tree | 9a0d4f8553773531a158a91b8579c74ee09becda | |
| parent | 3ccee821acc34514d9c7cf972c0efae157c6fc5c (diff) | |
xkb: reset the radio_groups pointer to NULL after freeing it
Unlike other elements of the keymap, this pointer was freed but not
reset. On a subsequent XkbGetKbdByName request, the server may access
already freed memory.
CVE-2022-4283, ZDI-CAN-19530
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit ccdd431cd8f1cabae9d744f0514b6533c438908c)
| -rw-r--r-- | xkb/xkbUtils.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c index 8975ade8d..9bc51fc71 100644 --- a/xkb/xkbUtils.c +++ b/xkb/xkbUtils.c @@ -1327,6 +1327,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst) } else { free(dst->names->radio_groups); + dst->names->radio_groups = NULL; } dst->names->num_rg = src->names->num_rg; |