Commit 8d2e02ae authored by Matthieu Herrb's avatar Matthieu Herrb Committed by Matthieu Herrb
Browse files

Reject string longer than USHRT_MAX before sending them on the wire



The X protocol uses CARD16 values to represent the length so
this would overflow.

CVE-2021-31535
Signed-off-by: Matthieu Herrb's avatarMatthieu Herrb <matthieu@herrb.eu>
parent 838ea5a5
......@@ -102,6 +102,8 @@ XFontStruct *XLoadQueryFont(
XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
#endif
if (strlen(name) >= USHRT_MAX)
return NULL;
if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
return font_result;
LockDisplay(dpy);
......@@ -663,7 +665,7 @@ int _XF86LoadQueryLocaleFont(
if (!name)
return 0;
l = (int) strlen(name);
if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
return 0;
charset = NULL;
/* next three lines stolen from _XkbGetCharset() */
......
......@@ -58,6 +58,9 @@ XFontStruct **info) /* RETURN */
register xListFontsReq *req;
int j;
if (strlen(pattern) >= USHRT_MAX)
return NULL;
LockDisplay(dpy);
GetReq(ListFontsWithInfo, req);
req->maxNames = maxNames;
......
......@@ -51,6 +51,9 @@ int *actualCount) /* RETURN */
register xListFontsReq *req;
unsigned long rlen = 0;
if (strlen(pattern) >= USHRT_MAX)
return NULL;
LockDisplay(dpy);
GetReq(ListFonts, req);
req->maxNames = maxNames;
......
......@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
......@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
XcmsColor cmsColor_exact;
Status ret;
if (strlen(colorname) >= USHRT_MAX)
return (0);
#ifdef XCMS
/*
* Let's Attempt to use Xcms and i18n approach to Parse Color
......
......@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <limits.h>
#include "Xlibint.h"
Font
......@@ -38,6 +39,9 @@ XLoadFont (
Font fid;
register xOpenFontReq *req;
if (strlen(name) >= USHRT_MAX)
return (0);
if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
return fid;
......
......@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
......@@ -46,6 +47,9 @@ XLookupColor (
XcmsCCC ccc;
XcmsColor cmsColor_exact;
n = (int) strlen (spec);
if (n >= USHRT_MAX)
return 0;
#ifdef XCMS
/*
* Let's Attempt to use Xcms and i18n approach to Parse Color
......@@ -77,8 +81,6 @@ XLookupColor (
* Xcms and i18n methods failed, so lets pass it to the server
* for parsing.
*/
n = (int) strlen (spec);
LockDisplay(dpy);
GetReq (LookupColor, req);
req->cmap = cmap;
......
......@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
......@@ -47,6 +48,8 @@ XParseColor (
if (!spec) return(0);
n = (int) strlen (spec);
if (n >= USHRT_MAX)
return(0);
if (*spec == '#') {
/*
* RGB
......
......@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <limits.h>
#include <stdbool.h>
#include "Xlibint.h"
Bool
......@@ -40,6 +42,9 @@ XQueryExtension(
xQueryExtensionReply rep;
register xQueryExtensionReq *req;
if (strlen(name) >= USHRT_MAX)
return false;
LockDisplay(dpy);
GetReq(QueryExtension, req);
req->nbytes = name ? (CARD16) strlen(name) : 0;
......
......@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#include <limits.h>
#endif
#include "Xlibint.h"
......@@ -49,6 +50,11 @@ XSetFontPath (
req->nFonts = ndirs;
for (i = 0; i < ndirs; i++) {
n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
if (n >= USHRT_MAX) {
UnlockDisplay(dpy);
SyncHandle();
return 0;
}
}
nbytes = (n + 3) & ~3;
req->length += nbytes >> 2;
......
......@@ -49,6 +49,7 @@ SOFTWARE.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <limits.h>
#include <X11/Xlibint.h>
#include <X11/Xutil.h>
#include "Xatomtype.h"
......@@ -214,6 +215,8 @@ XSetCommand (
register char *buf, *bp;
for (i = 0, nbytes = 0; i < argc; i++) {
nbytes += safestrlen(argv[i]) + 1;
if (nbytes >= USHRT_MAX)
return 1;
}
if ((bp = buf = Xmalloc(nbytes))) {
/* copy arguments into single buffer */
......@@ -256,6 +259,8 @@ XSetStandardProperties (
if (name != NULL) XStoreName (dpy, w, name);
if (safestrlen(icon_string) >= USHRT_MAX)
return 1;
if (icon_string != NULL) {
XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
PropModeReplace,
......@@ -298,6 +303,8 @@ XSetClassHint(
len_nm = safestrlen(classhint->res_name);
len_cl = safestrlen(classhint->res_class);
if (len_nm + len_cl >= USHRT_MAX)
return 1;
if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
if (len_nm) {
strcpy(s, classhint->res_name);
......
......@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
......@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
XcmsColor cmsColor_exact;
XColor scr_def;
if (strlen(name) >= USHRT_MAX)
return 0;
#ifdef XCMS
/*
* Let's Attempt to use Xcms approach to Parse Color
......
......@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <limits.h>
#include <X11/Xlibint.h>
#include <X11/Xatom.h>
......@@ -36,7 +37,9 @@ XStoreName (
Window w,
_Xconst char *name)
{
return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
if (strlen(name) >= USHRT_MAX)
return 0;
return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
8, PropModeReplace, (_Xconst unsigned char *)name,
name ? (int) strlen(name) : 0);
}
......@@ -47,6 +50,8 @@ XSetIconName (
Window w,
_Xconst char *icon_name)
{
if (strlen(icon_name) >= USHRT_MAX)
return 0;
return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
PropModeReplace, (_Xconst unsigned char *)icon_name,
icon_name ? (int) strlen(icon_name) : 0);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment