From 0885e0b26225c90534642fe911632ec0779eebee Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Fri, 28 Mar 2025 09:43:52 +0100 Subject: [PATCH] render: Avoid 0 or less animated cursors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Animated cursors use a series of cursors that the client can set. By default, the Xserver assumes at least one cursor is specified while a client may actually pass no cursor at all. That causes an out-of-bound read creating the animated cursor and a crash of the Xserver: | Invalid read of size 8 | at 0x5323F4: AnimCursorCreate (animcur.c:325) | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) | by 0x52DC80: ProcRenderDispatch (render.c:1999) | by 0x4A1E9D: Dispatch (dispatch.c:560) | by 0x4B0169: dix_main (main.c:284) | by 0x4287F5: main (stubmain.c:34) | Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd | at 0x48468D3: reallocarray (vg_replace_malloc.c:1803) | by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802) | by 0x52DC80: ProcRenderDispatch (render.c:1999) | by 0x4A1E9D: Dispatch (dispatch.c:560) | by 0x4B0169: dix_main (main.c:284) | by 0x4287F5: main (stubmain.c:34) | | Invalid read of size 2 | at 0x5323F7: AnimCursorCreate (animcur.c:325) | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) | by 0x52DC80: ProcRenderDispatch (render.c:1999) | by 0x4A1E9D: Dispatch (dispatch.c:560) | by 0x4B0169: dix_main (main.c:284) | by 0x4287F5: main (stubmain.c:34) | Address 0x8 is not stack'd, malloc'd or (recently) free'd To avoid the issue, check the number of cursors specified and return a BadValue error in both the proc handler (early) and the animated cursor creation (as this is a public function) if there is 0 or less cursor. CVE-2025-49175 This issue was discovered by Nils Emmerich and reported by Julian Suleder via ERNW Vulnerability Disclosure. Signed-off-by: Olivier Fourdan Reviewed-by: José Expósito Part-of: --- render/animcur.c | 3 +++ render/render.c | 2 ++ 2 files changed, 5 insertions(+) diff --git a/render/animcur.c b/render/animcur.c index f906cd8130..1194cee7e7 100644 --- a/render/animcur.c +++ b/render/animcur.c @@ -305,6 +305,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor, int rc = BadAlloc, i; AnimCurPtr ac; + if (ncursor <= 0) + return BadValue; + for (i = 0; i < screenInfo.numScreens; i++) if (!GetAnimCurScreen(screenInfo.screens[i])) return BadImplementation; diff --git a/render/render.c b/render/render.c index 113f6e0c5a..fe9f03c8c8 100644 --- a/render/render.c +++ b/render/render.c @@ -1799,6 +1799,8 @@ ProcRenderCreateAnimCursor(ClientPtr client) ncursor = (client->req_len - (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1; + if (ncursor <= 0) + return BadValue; cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32)); if (!cursors) return BadAlloc; -- GitLab