From 475d9f49acd0e55bc0b089ed77f732ad18585470 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Wed, 10 Sep 2025 16:30:29 +0200 Subject: [PATCH] xkb: Prevent overflow in XkbSetCompatMap() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The XkbCompatMap structure stores its "num_si" and "size_si" fields using an unsigned short. However, the function _XkbSetCompatMap() will store the sum of the input data "firstSI" and "nSI" in both XkbCompatMap's "num_si" and "size_si" without first checking if the sum overflows the maximum unsigned short value, leading to a possible overflow. To avoid the issue, check whether the sum does not exceed the maximum unsigned short value, or return a "BadValue" error otherwise. CVE-2025-62231, ZDI-CAN-27560 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative Signed-off-by: Olivier Fourdan Reviewed-by: Michel Dänzer Part-of: --- xkb/xkb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/xkb/xkb.c b/xkb/xkb.c index 5f6420f9ee..6e718df8b7 100644 --- a/xkb/xkb.c +++ b/xkb/xkb.c @@ -2990,6 +2990,8 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev, XkbSymInterpretPtr sym; unsigned int skipped = 0; + if ((unsigned) (req->firstSI + req->nSI) > USHRT_MAX) + return BadValue; if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) { compat->num_si = compat->size_si = req->firstSI + req->nSI; compat->sym_interpret = reallocarray(compat->sym_interpret, -- GitLab