Xi: allocate enough XkbActions for our buttons

CVE-2023-6377

1 files changed, 11 insertions, 0 deletions

diff --git a/xserver/dix/devices.c b/xserver/dix/devices.c
index 5bf956ead..ed8c5aee7 100644
--- a/xserver/dix/devices.c
+++ b/xserver/dix/devices.c
@@ -2525,6 +2525,8 @@ RecalculateMasterButtons(DeviceIntPtr slave)
 
     if (master->button && master->button->numButtons != maxbuttons) {
         int i;
+        int last_num_buttons = master->button->numButtons;
+
         DeviceChangedEvent event = {
             .header = ET_Internal,
             .type = ET_DeviceChanged,
@@ -2535,6 +2537,15 @@ RecalculateMasterButtons(DeviceIntPtr slave)
         };
 
         master->button->numButtons = maxbuttons;
+        if (last_num_buttons < maxbuttons) {
+            master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts,
+                                                       maxbuttons,
+                                                       sizeof(XkbAction));
+            memset(&master->button->xkb_acts[last_num_buttons],
+                   0,
+                   (maxbuttons - last_num_buttons) * sizeof(XkbAction));
+        }
+
 
         memcpy(&event.buttons.names, master->button->labels, maxbuttons *
                sizeof(Atom));