diff options
author | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2023-02-07 06:32:19 +0000 |
---|---|---|
committer | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2023-02-07 06:32:19 +0000 |
commit | b3504d033906b3b3ab0714786a7a55686a8b49d9 (patch) | |
tree | 7d8db1f7fbad63016fb2f3a9ac50ac594feaf91a /xserver | |
parent | 1097b90b4a36bc01d267b5fdf42d5698e7645e49 (diff) |
Xi: fix use-after-free in DeepCopyPointerClasses
CVE-2023-0494, ZDI-CAN-19596
Diffstat (limited to 'xserver')
-rw-r--r-- | xserver/Xi/exevents.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/xserver/Xi/exevents.c b/xserver/Xi/exevents.c index 217baa956..dcd4efb3b 100644 --- a/xserver/Xi/exevents.c +++ b/xserver/Xi/exevents.c @@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) memcpy(to->button->xkb_acts, from->button->xkb_acts, sizeof(XkbAction)); } - else + else { free(to->button->xkb_acts); + to->button->xkb_acts = NULL; + } memcpy(to->button->labels, from->button->labels, from->button->numButtons * sizeof(Atom)); |