XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-03-23 23:30:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

dix: avoid null ptr deref at doListFontsAndAliases

Browse Source 
In the `doListFontsAndAliases` function in dixfonts.c, when a font alias
is encountered (`err == FontNameAlias`) as a result of
`list_next_font_or_alias` call, the code allocates memory for
`resolved` variable (`resolvedlen + 1` bytes) for storing target font
name. In this case, if the `malloc(resolvedlen + 1)` call fails,
`resolved` remains NULL.

Later, when check (`else if (err == FontNameAlias)`) is TRUE, the code
uses `memcpy` to copy nullable `resolved` into `tmp_pattern` without
checking if `resolved` is NULL, so there is a potential null ptr
dereference.

This commit replaces `malloc` with `XNFalloc` for allocating memory for
`resolved`. `XNFalloc` will internally check result of `malloc` and stop
program execution if allocation was failed, preventing potential NULL
dereferencing.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2114>
This commit is contained in:
Mikhail Dmitrichenko
2026-03-14 18:59:44 +02:00
committed by Enrico Weigelt
parent 4eeb22c8be
commit 9036215b02
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
dix/dixfonts.c
View File

@@ -630,9 +630,8 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
} }
if (err == FontNameAlias) { if (err == FontNameAlias) {
free(resolved); free(resolved);
resolved = calloc(1, resolvedlen + 1); resolved = XNFalloc(resolvedlen + 1);
if (resolved) memcpy(resolved, tmpname, resolvedlen + 1);
memcpy(resolved, tmpname, resolvedlen + 1);
} }
} }