summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlan Coopersmith <alan.coopersmith@oracle.com>2013-05-01 17:59:31 -0700
committerAlan Coopersmith <alan.coopersmith@oracle.com>2013-05-23 14:36:48 -0700
commit75680fde0dd4173e2bd8465cebb3e996a7236df1 (patch)
treecd50e585551b812499d604828fde0f48a5c28711
parent6b6044cb8aacdf1b637da7b5dda392f9ff41ed39 (diff)
integer overflow in read_packet() [CVE-2013-2064]
Ensure that when calculating the size of the incoming response from the Xserver, we don't overflow the integer used in the calculations when we multiply the int32_t length by 4 and add it to the default response size. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> (cherry picked from commit 1b33867fa996034deb50819ae54640be501f8d20)
-rw-r--r--src/xcb_in.c13
1 files changed, 9 insertions, 4 deletions
diff --git a/src/xcb_in.c b/src/xcb_in.c
index b810783..8a7af92 100644
--- a/src/xcb_in.c
+++ b/src/xcb_in.c
@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
static int read_packet(xcb_connection_t *c)
{
xcb_generic_reply_t genrep;
- int length = 32;
- int eventlength = 0; /* length after first 32 bytes for GenericEvents */
+ uint64_t length = 32;
+ uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
+ uint64_t bufsize;
void *buf;
pending_reply *pend = 0;
struct event_list *event;
@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
eventlength = genrep.length * 4;
- buf = malloc(length + eventlength +
- (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
+ bufsize = length + eventlength +
+ (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
+ if (bufsize < INT32_MAX)
+ buf = malloc((size_t) bufsize);
+ else
+ buf = NULL;
if(!buf)
{
_xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);