Skip to content

[duplicate] xfixes/xace: fix pointer type mismatch on XFixesSelectSelectionInput()

Enrico Weigelt, metux IT consult requested to merge metux/xserver:submit/security-xace-fix into master

This could potentially be security related or crash the server:

XFixesSelectSelectionInput() calls the XACE_SELECTION_ACCESS hook with wrong parameter type: XID instead of pointer to Selection struct. It seems that it hadn't been kept up in XACE changed to polyinstantiation.

When XACE is used (eg. Security or SELinux extension enabled), this can easily lead to memory corruptions at attacker-controlled locations, since the client-given XID is interpreted as the memory location of Selection structure.

Signed-off-by: Enrico Weigelt, metux IT consult info@metux.net

Merge request reports