From c3d6799cee7ff8411b3a05a7ab7e2a9e80c95059 Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@fooishbar.org>
Date: Tue, 13 Sep 2005 01:33:19 +0000
Subject: Bug #594: CAN-2005-2495: Fix exploitable integer overflow in pixmap  
   creation, where we could create a far smaller pixmap than we thought,    
 allowing changes to arbitrary chunks of memory. (Søren Sandmann     Pedersen)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 fb/fbpixmap.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'fb')

diff --git a/fb/fbpixmap.c b/fb/fbpixmap.c
index 1cb34e4d9..decc07ba6 100644
--- a/fb/fbpixmap.c
+++ b/fb/fbpixmap.c
@@ -36,12 +36,14 @@ PixmapPtr
 fbCreatePixmapBpp (ScreenPtr pScreen, int width, int height, int depth, int bpp)
 {
     PixmapPtr	pPixmap;
-    int		datasize;
-    int		paddedWidth;
+    size_t	datasize;
+    size_t	paddedWidth;
     int		adjust;
     int		base;
 
     paddedWidth = ((width * bpp + FB_MASK) >> FB_SHIFT) * sizeof (FbBits);
+    if (paddedWidth / 4 > 32767 || height > 32767)
+	return NullPixmap;
     datasize = height * paddedWidth;
 #ifdef PIXPRIV
     base = pScreen->totalPixmapSize;
-- 
cgit v1.2.3