current/SOURCES/0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch

From 774260dbae1fa505cd2848c786baed9a8db5179d Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 5 Dec 2022 15:55:54 +1000
Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after
 freeing it

Unlike other elements of the keymap, this pointer was freed but not
reset. On a subsequent XkbGetKbdByName request, the server may access
already freed memory.

CVE-2022-46283, ZDI-CAN-19530

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
---
 xkb/xkbUtils.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
index dd089c2046..3f5791a183 100644
--- a/xkb/xkbUtils.c
+++ b/xkb/xkbUtils.c
@@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
         }
         else {
             free(dst->names->radio_groups);
+            dst->names->radio_groups = NULL;
         }
         dst->names->num_rg = src->names->num_rg;
 
-- 
2.38.1

1	ns80	1932107	From 774260dbae1fa505cd2848c786baed9a8db5179d Mon Sep 17 00:00:00 2001
2			From: Peter Hutterer <peter.hutterer@who-t.net>
3			Date: Mon, 5 Dec 2022 15:55:54 +1000
4			Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after
5			freeing it
6
7			Unlike other elements of the keymap, this pointer was freed but not
8			reset. On a subsequent XkbGetKbdByName request, the server may access
9			already freed memory.
10
11			CVE-2022-46283, ZDI-CAN-19530
12
13			This vulnerability was discovered by:
14			Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
15
16			Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
17			Acked-by: Olivier Fourdan <ofourdan@redhat.com>
18			---
19			xkb/xkbUtils.c \| 1 +
20			1 file changed, 1 insertion(+)
21
22			diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
23			index dd089c2046..3f5791a183 100644
24			--- a/xkb/xkbUtils.c
25			+++ b/xkb/xkbUtils.c
26			@@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
27			}
28			else {
29			free(dst->names->radio_groups);
30			+ dst->names->radio_groups = NULL;
31			}
32			dst->names->num_rg = src->names->num_rg;
33
34			--
35			2.38.1
36