XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-04-14 17:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

dix: avoid null ptr deref at doListFontsWithInfo

Browse Source 
In the doListFontsWithInfo function in dixfonts.c, when a font alias is
encountered (err == FontNameAlias), the code saves the current state
and allocates memory for c->savedName.

If the malloc(namelen + 1) call fails, c->savedName remains NULL,
but c->haveSaved is still set to TRUE. Later, when a font is
successfully resolved (err == Successful), the code uses c->savedName
without checking if it is NULL, so there is potential null ptr
dereference. XNFalloc will check result of malloc and stop
program execution if allocation was failed.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1842

Signed-off-by: default avatarMikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2062>
This commit is contained in:
Mikhail Dmitrichenko
2025-10-01 17:11:13 +03:00
committed by Enrico Weigelt
parent 0a5815b075
commit de025ce306
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
dix/dixfonts.c
View File

@@ -907,9 +907,8 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
c->haveSaved = TRUE;
c->savedNumFonts = numFonts;
free(c->savedName);
c->savedName = calloc(1, namelen + 1);
if (c->savedName)
memcpy(c->savedName, name, namelen + 1);
c->savedName = XNFalloc(namelen + 1);
memcpy(c->savedName, name, namelen + 1);
aliascount = 20;
}
memmove(c->current.pattern, name, namelen);