Bug #594: CAN-2005-2495: Fix exploitable integer overflow in pixmap

    creation, where we could create a far smaller pixmap than we thought,
    allowing changes to arbitrary chunks of memory. (Søren Sandmann
    Pedersen)

1 files changed, 4 insertions, 2 deletions

diff --git a/ilbm/ilbmpixmap.c b/ilbm/ilbmpixmap.c
index bd977e627..33c317155 100644
--- a/ilbm/ilbmpixmap.c
+++ b/ilbm/ilbmpixmap.c
@@ -79,10 +79,12 @@ ilbmCreatePixmap(pScreen, width, height, depth)
 	int				depth;
 {
 	PixmapPtr pPixmap;
-	int datasize;
-	int paddedWidth;
+	size_t datasize;
+	size_t paddedWidth;
 
 	paddedWidth = BitmapBytePad(width);
+	if (paddedWidth > 32767 || height > 32767 || depth > 4)
+		return NullPixmap;
 	datasize = height * paddedWidth * depth;
 	pPixmap = AllocatePixmap(pScreen, datasize);
 	if (!pPixmap)