CVS commit: [netbsd-9] xsrc/external/mit/xorg-server/dist/Xi

[Martin Husemann]

Module Name:    xsrc
Committed By:   martin
Date:           Tue Apr 27 10:37:02 UTC 2021

Modified Files:
        xsrc/external/mit/xorg-server/dist/Xi [netbsd-9]: chgfctl.c

Log Message:
Apply patch, requested by mrg in ticket #1257:

        external/mit/xorg-server/dist/Xi/chgfctl.c      (apply patch)

Fix for CVE-2021-3472 (local privilege escalation).


To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.4.2.1 xsrc/external/mit/xorg-server/dist/Xi/chgfctl.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: xsrc/external/mit/xorg-server/dist/Xi/chgfctl.c
diff -u xsrc/external/mit/xorg-server/dist/Xi/chgfctl.c:1.4 xsrc/external/mit/xorg-server/dist/Xi/chgfctl.c:1.4.2.1
--- xsrc/external/mit/xorg-server/dist/Xi/chgfctl.c:1.4	Mon Dec 31 09:49:58 2018
+++ xsrc/external/mit/xorg-server/dist/Xi/chgfctl.c	Tue Apr 27 10:37:01 2021
@@ -464,8 +464,11 @@ ProcXChangeFeedbackControl(ClientPtr cli
         break;
     case StringFeedbackClass:
     {
-        xStringFeedbackCtl *f = ((xStringFeedbackCtl *) &stuff[1]);
+        xStringFeedbackCtl *f;
 
+        REQUEST_AT_LEAST_EXTRA_SIZE(xChangeFeedbackControlReq,
+                                    sizeof(xStringFeedbackCtl));
+        f = ((xStringFeedbackCtl *) &stuff[1]);
         if (client->swapped) {
             if (len < bytes_to_int32(sizeof(xStringFeedbackCtl)))
                 return BadLength;