From 79916ec4eed724b481d24d97686d3ed05a939859 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 5 Dec 2022 15:55:54 +1000
Subject: [PATCH xserver] xkb: reset the radio_groups pointer to NULL after
 freeing it

Unlike other elements of the keymap, this pointer was freed but not
reset. On a subsequent XkbGetKbdByName request, the server may access
already freed memory.

ZDI-CAN-19530

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 xkb/xkbUtils.c | 1 +
 1 file changed, 1 insertion(+)

Index: xorg-server-1.6.5/xkb/xkbUtils.c
===================================================================
--- xorg-server-1.6.5.orig/xkb/xkbUtils.c
+++ xorg-server-1.6.5/xkb/xkbUtils.c
@@ -1427,8 +1427,10 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr
                    src->names->num_rg * sizeof(Atom));
         }
         else {
-            if (dst->names->radio_groups)
+            if (dst->names->radio_groups) {
                 xfree(dst->names->radio_groups);
+                dst->names->radio_groups = NULL;
+            }
         }
         dst->names->num_rg = src->names->num_rg;