diff options
| author | Julien Cristau <jcristau@debian.org> | 2014-10-28 10:30:04 +0100 |
|---|---|---|
| committer | Julien Cristau <jcristau@debian.org> | 2014-12-09 17:50:13 +0100 |
| commit | 0ad9121071adf1425623170c9d3bc19333d0f1a2 (patch) | |
| tree | 8f575515dc480e4df3a64f5d30412b4ade9bf19f | |
| parent | df64ac720642c86efcc47b64621e8a0f1e705f16 (diff) | |
render: check request size before reading it [CVE-2014-8100 1/2]
Otherwise we may be reading outside of the client request.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit b5f9ef03df6a650571b29d3d1c1d2b67c6e84336)
Signed-off-by: Julien Cristau <jcristau@debian.org>
| -rw-r--r-- | render/render.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/render/render.c b/render/render.c index 9ac4a98e7..95e50a22c 100644 --- a/render/render.c +++ b/render/render.c @@ -276,11 +276,11 @@ ProcRenderQueryVersion(ClientPtr client) REQUEST(xRenderQueryVersionReq); + REQUEST_SIZE_MATCH(xRenderQueryVersionReq); + pRenderClient->major_version = stuff->majorVersion; pRenderClient->minor_version = stuff->minorVersion; - REQUEST_SIZE_MATCH(xRenderQueryVersionReq); - if ((stuff->majorVersion * 1000 + stuff->minorVersion) < (SERVER_RENDER_MAJOR_VERSION * 1000 + SERVER_RENDER_MINOR_VERSION)) { rep.majorVersion = stuff->majorVersion; |