diff options
| author | Daniel Stone <daniel@fooishbar.org> | 2005-09-13 01:33:19 +0000 |
|---|---|---|
| committer | Daniel Stone <daniel@fooishbar.org> | 2005-09-13 01:33:19 +0000 |
| commit | c3d6799cee7ff8411b3a05a7ab7e2a9e80c95059 (patch) | |
| tree | 0afd730bf28bc833a2e7ba13070190448bf56bfa /mfb/mfbpixmap.c | |
| parent | b290884719e18646326f0c2412c2494a07fe3cfd (diff) | |
Bug #594: CAN-2005-2495: Fix exploitable integer overflow in pixmap
creation, where we could create a far smaller pixmap than we thought,
allowing changes to arbitrary chunks of memory. (Søren Sandmann
Pedersen)
Diffstat (limited to 'mfb/mfbpixmap.c')
| -rw-r--r-- | mfb/mfbpixmap.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/mfb/mfbpixmap.c b/mfb/mfbpixmap.c index c3d5d5ea6..ad0dfe79f 100644 --- a/mfb/mfbpixmap.c +++ b/mfb/mfbpixmap.c @@ -75,12 +75,14 @@ mfbCreatePixmap (pScreen, width, height, depth) int depth; { PixmapPtr pPixmap; - int datasize; - int paddedWidth; + size_t datasize; + size_t paddedWidth; if (depth != 1) return NullPixmap; paddedWidth = BitmapBytePad(width); + if (paddedWidth / 4 > 32767 || height > 32767) + return NullPixmap; datasize = height * paddedWidth; pPixmap = AllocatePixmap(pScreen, datasize); if (!pPixmap) |