Merge upstream fixes to the X event swapping code.

(CVE-2017-10971 and CVE-2017-10972).

2 files changed, 13 insertions, 0 deletions

diff --git a/xserver/dix/events.c b/xserver/dix/events.c
index efaf91d2b..0591f8fcb 100644
--- a/xserver/dix/events.c
+++ b/xserver/dix/events.c
@@ -5355,6 +5355,12 @@ ProcSendEvent(ClientPtr client)
         client->errorValue = stuff->event.u.u.type;
         return BadValue;
     }
+    /* Generic events can have variable size, but SendEvent request holds
+       exactly 32B of event data. */
+    if (stuff->event.u.u.type == GenericEvent) {
+        client->errorValue = stuff->event.u.u.type;
+        return BadValue;
+    }
     if (stuff->event.u.u.type == ClientMessage &&
         stuff->event.u.u.detail != 8 &&
         stuff->event.u.u.detail != 16 && stuff->event.u.u.detail != 32) {
diff --git a/xserver/dix/swapreq.c b/xserver/dix/swapreq.c
index 61d3ce0f4..8cc64b6ed 100644
--- a/xserver/dix/swapreq.c
+++ b/xserver/dix/swapreq.c
@@ -292,6 +292,13 @@ SProcSendEvent(ClientPtr client)
     swapl(&stuff->destination);
     swapl(&stuff->eventMask);
 
+    /* Generic events can have variable size, but SendEvent request holds
+       exactly 32B of event data. */
+    if (stuff->event.u.u.type == GenericEvent) {
+        client->errorValue = stuff->event.u.u.type;
+        return BadValue;
+    }
+
     /* Swap event */
     proc = EventSwapVector[stuff->event.u.u.type & 0177];
     if (!proc || proc == NotImplemented)        /* no swapping proc; invalid event type? */