[Git][xorg-team/wayland/xwayland][debian-unstable] 6 commits: dix: Correctly save replayed event into GrabInfoRec

Timo Aaltonen pushed to branch debian-unstable at X Strike Force / wayland / xwayland

Commits:

905bc7f7

by Povilas Kanapickas at 2023-01-25T13:16:49+10:00

dix: Correctly save replayed event into GrabInfoRec

When processing events we operate on InternalEvent pointers. They may
actually refer to a an instance of DeviceEvent, GestureEvent or any
other event that comprises the InternalEvent union. This works well in
practice because we always look into event type before doing anything,
except in the case of copying the event.

*dst_event = *src_event would copy whole InternalEvent event and would
cause out of bounds read in case the pointed to event was not
InternalEvent but e.g. DeviceEvent.

This regression has been introduced in
23a8b62d34344575f9df9d057fb74bfefa94a77b.

Fixes https://gitlab.freedesktop.org/xorg/xserver/-/issues/1261

Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
(cherry picked from commit 6ef5c05728f8b18170fbc8415d7502495a08670b)

8e392628

by Mike Gorse at 2023-01-25T13:16:49+10:00

dix: Use CopyPartialInternalEvent in EnqueueEvent

The event might be a DeviceEvent allocated on the stack, in
AccessXKeyboardEvent for instance. Fixes out-of-bounds read.

Signed-off-by: Mike Gorse <mgorse@suse.com>
(cherry picked from commit 2ef5ef57bd37a8bec2ac454053b283c6f87c3b40)

8660dd16

by Peter Hutterer at 2023-02-07T08:30:43+01:00

Xi: fix potential use-after-free in DeepCopyPointerClasses

CVE-2023-0494, ZDI-CAN-19596

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 0ba6d8c37071131a49790243cdac55392ecf71ec)

92c35190

by Olivier Fourdan at 2023-02-07T08:30:43+01:00

Bump version to 22.1.8

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>

722e67df

by Timo Aaltonen at 2023-02-07T15:13:29+02:00

Merge branch 'upstream-unstable' into debian-unstable

51c7440e
by Timo Aaltonen at 2023-02-07T15:14:47+02:00
```
release to sid
```

Changes:

Xi/exevents.c

@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
              memcpy(to->button->xkb_acts, from->button->xkb_acts,
                     sizeof(XkbAction));
+         }
 -        else
 +        else {
              free(to->button->xkb_acts);
 +            to->button->xkb_acts = NULL;
 +        }
          memcpy(to->button->labels, from->button->labels,
                 from->button->numButtons * sizeof(Atom));
@@ -1524,7 +1526,7 @@ DeliverTouchEmulatedEvent(DeviceIntPtr dev, TouchPointInfoPtr ti,
              g = AllocGrab(devgrab);
              BUG_WARN(!g);
 -            *dev->deviceGrab.sync.event = *ev;
 +            CopyPartialInternalEvent(dev->deviceGrab.sync.event, ev);
              /* The listener array has a sequence of grabs and then one event
               * selection. Implicit grab activation occurs through delivering an

debian/changelog

 +xwayland (2:22.1.8-1) unstable; urgency=medium
++
 +  * New upstream release.
 +    - CVE-2023-0494
++
 + -- Timo Aaltonen <tjaalton@debian.org>  Tue, 07 Feb 2023 15:14:38 +0200
++
  xwayland (2:22.1.7-1) unstable; urgency=medium
    * New upstream release.

dix/events.c

@@ -467,6 +467,20 @@ WindowXI2MaskIsset(DeviceIntPtr dev, WindowPtr win, xEvent *ev)
      return xi2mask_isset(inputMasks->xi2mask, dev, evtype);
+ }
 +/**
 + * When processing events we operate on InternalEvent pointers. They may actually refer to a
 + * an instance of DeviceEvent, GestureEvent or any other event that comprises the InternalEvent
 + * union. This works well in practice because we always look into event type before doing anything,
 + * except in the case of copying the event. Any copying of InternalEvent should use this function
 + * instead of doing *dst_event = *src_event whenever it's not clear whether source event actually
 + * points to full InternalEvent instance.
 + */
 +void
 +CopyPartialInternalEvent(InternalEvent* dst_event, const InternalEvent* src_event)
 +{
 +    memcpy(dst_event, src_event, src_event->any.length);
 +}
++
  Mask
  GetEventMask(DeviceIntPtr dev, xEvent *event, InputClients * other)
+ {
@@ -1201,7 +1215,7 @@ EnqueueEvent(InternalEvent *ev, DeviceIntPtr device)
      qe->pScreen = pSprite->hotPhys.pScreen;
      qe->months = currentTime.months;
      qe->event = (InternalEvent *) (qe + 1);
 -    memcpy(qe->event, event, eventlen);
 +    CopyPartialInternalEvent(qe->event, (InternalEvent *)event);
      xorg_list_append(&qe->next, &syncEvents.pending);
+ }
@@ -3873,7 +3887,7 @@ void ActivateGrabNoDelivery(DeviceIntPtr dev, GrabPtr grab,
      if (grabinfo->sync.state == FROZEN_NO_EVENT)
          grabinfo->sync.state = FROZEN_WITH_EVENT;
 -    *grabinfo->sync.event = *real_event;
 +    CopyPartialInternalEvent(grabinfo->sync.event, real_event);
+ }
  static BOOL
@@ -4455,7 +4469,7 @@ FreezeThisEventIfNeededForSyncGrab(DeviceIntPtr thisDev, InternalEvent *event)
      case FREEZE_NEXT_EVENT:
          grabinfo->sync.state = FROZEN_WITH_EVENT;
          FreezeThaw(thisDev, TRUE);
 -        *grabinfo->sync.event = *event;
 +        CopyPartialInternalEvent(grabinfo->sync.event, event);
          break;
+     }
+ }

include/input.h

@@ -676,6 +676,7 @@ extern void GestureEmitGestureEndToOwner(DeviceIntPtr dev, GestureInfoPtr gi);
  extern void ProcessGestureEvent(InternalEvent *ev, DeviceIntPtr dev);
  /* misc event helpers */
 +extern void CopyPartialInternalEvent(InternalEvent* dst_event, const InternalEvent* src_event);
  extern Mask GetEventMask(DeviceIntPtr dev, xEvent *ev, InputClientsPtr clients);
  extern Mask GetEventFilter(DeviceIntPtr dev, xEvent *event);
  extern Bool WindowXI2MaskIsset(DeviceIntPtr dev, WindowPtr win, xEvent *ev);

meson.build

@@ -3,10 +3,10 @@ project('xwayland', 'c',
              'buildtype=debugoptimized',
              'c_std=gnu99',
          ],
 -        version: '22.1.7',
 +        version: '22.1.8',
          meson_version: '>= 0.47.0',
+ )
 -release_date = '2022-12-19'
 +release_date = '2023-02-07'
  add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc'])
  cc = meson.get_compiler('c')