untrusted comment: verify with openbsd-73-base.pub
RWQS90bYzZ4XFp8ZhwQWR7Wc2HstPBh2Lk9zzQbLHXk9ZoKw/TF0jR0BanGL9HXPT7lJGGKhpcYDmntBCDBNeLiRl2mbW10ijQs=
OpenBSD 7.3 errata 023, December 14, 2023:
Fix out of bounds memory accesses in XRandR and XKB X server extensions.
CVE-2023-6377 CVE-2023-6478
Apply by doing:
signify -Vep /etc/signify/openbsd-73-base.pub -x 023_xserver.patch.sig \
-m - | (cd /usr/xenocara && patch -p0)
And then rebuild and install the X server:
cd /usr/xenocara/xserver
make -f Makefile.bsd-wrapper obj
make -f Makefile.bsd-wrapper build
Index: xserver/Xi/exevents.c
===================================================================
RCS file: /cvs/xenocara/xserver/Xi/exevents.c,v
diff -u -p -r1.27 exevents.c
--- xserver/Xi/exevents.c 7 Feb 2023 06:32:18 -0000 1.27
+++ xserver/Xi/exevents.c 13 Dec 2023 12:39:50 -0000
@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from
}
if (from->button->xkb_acts) {
- if (!to->button->xkb_acts) {
- to->button->xkb_acts = calloc(1, sizeof(XkbAction));
- if (!to->button->xkb_acts)
- FatalError("[Xi] not enough memory for xkb_acts.\n");
- }
+ size_t maxbuttons = max(to->button->numButtons, from->button->numButtons);
+ to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts,
+ maxbuttons,
+ sizeof(XkbAction));
+ memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction));
memcpy(to->button->xkb_acts, from->button->xkb_acts,
- sizeof(XkbAction));
+ from->button->numButtons * sizeof(XkbAction));
}
else {
free(to->button->xkb_acts);
Index: xserver/dix/devices.c
===================================================================
RCS file: /cvs/xenocara/xserver/dix/devices.c,v
diff -u -p -r1.28 devices.c
--- xserver/dix/devices.c 11 Nov 2021 09:03:03 -0000 1.28
+++ xserver/dix/devices.c 13 Dec 2023 12:39:50 -0000
@@ -2525,6 +2525,8 @@ RecalculateMasterButtons(DeviceIntPtr sl
if (master->button && master->button->numButtons != maxbuttons) {
int i;
+ int last_num_buttons = master->button->numButtons;
+
DeviceChangedEvent event = {
.header = ET_Internal,
.type = ET_DeviceChanged,
@@ -2535,6 +2537,15 @@ RecalculateMasterButtons(DeviceIntPtr sl
};
master->button->numButtons = maxbuttons;
+ if (last_num_buttons < maxbuttons) {
+ master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts,
+ maxbuttons,
+ sizeof(XkbAction));
+ memset(&master->button->xkb_acts[last_num_buttons],
+ 0,
+ (maxbuttons - last_num_buttons) * sizeof(XkbAction));
+ }
+
memcpy(&event.buttons.names, master->button->labels, maxbuttons *
sizeof(Atom));
Index: xserver/randr/rrproperty.c
===================================================================
RCS file: /cvs/xenocara/xserver/randr/rrproperty.c,v
diff -u -p -r1.12.16.1 rrproperty.c
--- xserver/randr/rrproperty.c 25 Oct 2023 08:14:42 -0000 1.12.16.1
+++ xserver/randr/rrproperty.c 13 Dec 2023 12:39:50 -0000
@@ -530,7 +530,7 @@ ProcRRChangeOutputProperty(ClientPtr cli
char format, mode;
unsigned long len;
int sizeInBytes;
- int totalSize;
+ uint64_t totalSize;
int err;
REQUEST_AT_LEAST_SIZE(xRRChangeOutputPropertyReq);
Index: xserver/randr/rrproviderproperty.c
===================================================================
RCS file: /cvs/xenocara/xserver/randr/rrproviderproperty.c,v
diff -u -p -r1.3 rrproviderproperty.c
--- xserver/randr/rrproviderproperty.c 29 May 2016 12:02:40 -0000 1.3
+++ xserver/randr/rrproviderproperty.c 13 Dec 2023 12:39:50 -0000
@@ -498,7 +498,7 @@ ProcRRChangeProviderProperty(ClientPtr c
char format, mode;
unsigned long len;
int sizeInBytes;
- int totalSize;
+ uint64_t totalSize;
int err;
REQUEST_AT_LEAST_SIZE(xRRChangeProviderPropertyReq);
