summaryrefslogtreecommitdiffstats
path: root/patches/source/xorg-server/patch/xorg-server/CVE-2022-3553.patch
blob: 593545d0391e4cef0bb14c259ef5d818ff4850ad (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
From dfd057996b26420309c324ec844a5ba6dd07eda3 Mon Sep 17 00:00:00 2001
From: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date: Sat, 2 Jul 2022 14:17:18 -0700
Subject: xquartz: Fix a possible crash when editing the Application menu due
 to mutaing immutable arrays

Crashing on exception: -[__NSCFArray replaceObjectAtIndex:withObject:]: mutating method sent to immutable object

Application Specific Backtrace 0:
0   CoreFoundation                      0x00007ff80d2c5e9b __exceptionPreprocess + 242
1   libobjc.A.dylib                     0x00007ff80d027e48 objc_exception_throw + 48
2   CoreFoundation                      0x00007ff80d38167b _CFThrowFormattedException + 194
3   CoreFoundation                      0x00007ff80d382a25 -[__NSCFArray removeObjectAtIndex:].cold.1 + 0
4   CoreFoundation                      0x00007ff80d2e6c0b -[__NSCFArray replaceObjectAtIndex:withObject:] + 119
5   X11.bin                             0x00000001003180f9 -[X11Controller tableView:setObjectValue:forTableColumn:row:] + 169

Fixes: https://github.com/XQuartz/XQuartz/issues/267
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
---
 hw/xquartz/X11Controller.m | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/xquartz/X11Controller.m b/hw/xquartz/X11Controller.m
index 3b55bb6a5..e9a939312 100644
--- a/hw/xquartz/X11Controller.m
+++ b/hw/xquartz/X11Controller.m
@@ -469,8 +469,11 @@ extern char *bundle_id_prefix;
     self.table_apps = table_apps;
 
     NSArray * const apps = self.apps;
-    if (apps != nil)
-        [table_apps addObjectsFromArray:apps];
+    if (apps != nil) {
+        for (NSArray <NSString *> * row in apps) {
+            [table_apps addObject:row.mutableCopy];
+        }
+    }
 
     columns = [apps_table tableColumns];
     [[columns objectAtIndex:0] setIdentifier:@"0"];
-- 
cgit v1.2.1