summaryrefslogtreecommitdiff
path: root/xserver
diff options
context:
space:
mode:
authorMatthieu Herrb <matthieu@cvs.openbsd.org>2023-02-07 06:32:19 +0000
committerMatthieu Herrb <matthieu@cvs.openbsd.org>2023-02-07 06:32:19 +0000
commitb3504d033906b3b3ab0714786a7a55686a8b49d9 (patch)
tree7d8db1f7fbad63016fb2f3a9ac50ac594feaf91a /xserver
parent1097b90b4a36bc01d267b5fdf42d5698e7645e49 (diff)
Xi: fix use-after-free in DeepCopyPointerClasses
CVE-2023-0494, ZDI-CAN-19596
Diffstat (limited to 'xserver')
-rw-r--r--xserver/Xi/exevents.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/xserver/Xi/exevents.c b/xserver/Xi/exevents.c
index 217baa956..dcd4efb3b 100644
--- a/xserver/Xi/exevents.c
+++ b/xserver/Xi/exevents.c
@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
memcpy(to->button->xkb_acts, from->button->xkb_acts,
sizeof(XkbAction));
}
- else
+ else {
free(to->button->xkb_acts);
+ to->button->xkb_acts = NULL;
+ }
memcpy(to->button->labels, from->button->labels,
from->button->numButtons * sizeof(Atom));