xorg-server -- Information leak in the XkbSetGeometry request of X servers.

Peter Hutterer reports:

Olivier Fourdan from Red Hat has discovered a protocol handling
issue in the way the X server code base handles the XkbSetGeometry
request.
The issue stems from the server trusting the client to send valid
string lengths in the request data. A malicious client with string
lengths exceeding the request length can cause the server to copy
adjacent memory data into the XKB structs. This data is then
available to the client via the XkbGetGeometry request. The
data length is at least up to 64k, it is possible to obtain
more data by chaining strings, each string length is then
determined by whatever happens to be in that 16-bit region of
memory.
A similarly crafted request can likely cause the X server
to crash.