The previous fix from X.Org was incorrect. This fixes it.

Xi: allocate enough XkbActions for our buttons
CVE-2023-6377

1 files changed, 5 insertions, 9 deletions

diff --git a/xserver/Xi/exevents.c b/xserver/Xi/exevents.c
index f24de9eec..54ea11a93 100644
--- a/xserver/Xi/exevents.c
+++ b/xserver/Xi/exevents.c
@@ -611,15 +611,11 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
         }
 
         if (from->button->xkb_acts) {
-            if (!to->button->xkb_acts) {
-                to->button->xkb_acts = calloc(from->button->numButtons, sizeof(XkbAction));
-                if (!to->button->xkb_acts)
-                    FatalError("[Xi] not enough memory for xkb_acts.\n");
-            } else {
-                to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts,
-                                                       from->button->numButtons,
-                                                       sizeof(XkbAction));
-            }
+            size_t maxbuttons = max(to->button->numButtons, from->button->numButtons);
+            to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts,
+                                                   maxbuttons,
+                                                   sizeof(XkbAction));
+            memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction));
             memcpy(to->button->xkb_acts, from->button->xkb_acts,
                    from->button->numButtons * sizeof(XkbAction));
         }