xserver-multidpi/xkb
Michal Srb c17872d502 xkb: Fix heap overflow caused by optimized away min.
Calling strlen on char[4] that does not need to contain '\0' is wrong and X
server may end up running into uninitialized memory.

In addition GCC 8 is clever enough that it knows that strlen on char[4] can
return 0, 1, 2, 3 or cause undefined behavior. With this knowledge it can
optimize away the min(..., 4). In reality it can cause the memcpy to be called
with bigger size than 4 and overflow the destination buffer.

Fixes: 83913de25d (xkb: Silence some compiler warnings)
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/288
Signed-off-by: Matt Turner <mattst88@gmail.com>
(cherry picked from commit 74627d13c7)
2020-12-16 10:14:12 +01:00
..
Makefile.am XKB: Remove component listing support 2012-11-19 12:12:28 +10:00
README.compiled R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
XKBAlloc.c Convert XKB to new *allocarray functions 2015-04-21 16:57:54 -07:00
XKBGAlloc.c xkb: Fix heap overflow caused by optimized away min. 2020-12-16 10:14:12 +01:00
XKBMAlloc.c xserver: Unifdef HAVE_CONFIG_H 2017-03-23 13:19:51 -04:00
XKBMisc.c xserver: Unifdef HAVE_CONFIG_H 2017-03-23 13:19:51 -04:00
XKM_file_format.txt xkb: Add XKM file format description. 2010-02-02 10:03:21 +10:00
ddxBeep.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxCtrls.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxKillSrv.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxLEDs.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ddxLoad.c xkb: Print the xkbcomp path being executed when we fail to compile. 2017-11-01 10:38:27 +10:00
ddxPrivate.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
ddxVT.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
maprules.c xkb: fix check for appending '|' character when applying rules 2016-09-07 15:16:13 +10:00
meson.build Add a Meson build system alongside autotools. 2017-04-26 15:25:27 -07:00
xkb.c Check SetMap request length carefully. 2020-12-01 16:21:33 +00:00
xkb.h Move extension initialisation prototypes into extinit.h 2012-07-09 23:06:41 -07:00
xkbAccessX.c xkb: add hook to allow/deny AccessX key repeat 2016-06-03 09:39:42 +02:00
xkbActions.c xkb: fix turbo-repeat of RedirectKey-ed keysyms 2016-09-21 17:33:43 +10:00
xkbDflts.h Use ARRAY_SIZE all over the tree 2017-10-30 13:45:20 -04:00
xkbEvents.c dix: Squash some new gcc6 warnings 2016-04-29 11:19:58 -04:00
xkbInit.c xkb: Correct type of XkbDfltAccessXOptions. 2017-03-27 13:22:33 +10:00
xkbLEDs.c xkb: after changing the keymap, force an indicator update 2016-05-04 10:55:09 -04:00
xkbPrKeyEv.c xkb: Match key releases with an overlaid press 2017-01-04 13:23:31 +10:00
xkbSwap.c Fix XkbSelectEvents() integer underflow 2020-08-25 17:13:31 +02:00
xkbUtils.c xkb: initialize tsyms 2017-11-06 16:49:11 -05:00
xkbfmisc.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xkbgeom.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xkbout.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xkbtext.c xkb: Handle xkb formated string output safely (CVE-2017-13723) 2017-10-04 21:06:17 +02:00
xkmread.c Convert XKB to new *allocarray functions 2015-04-21 16:57:54 -07:00

README.compiled

The X server uses this directory to store the compiled version of the
current keymap and/or any scratch keymaps used by clients.  The X server
or some other tool might destroy or replace the files in this directory,
so it is not a safe place to store compiled keymaps for long periods of
time.  The default keymap for any server is usually stored in:
     X<num>-default.xkm
where <num> is the display number of the server in question, which makes
it possible for several servers *on the same host* to share the same 
directory.

Unless the X server is modified, sharing this directory between servers on
different hosts could cause problems.