From b5f9ef03df6a650571b29d3d1c1d2b67c6e84336 Mon Sep 17 00:00:00 2001 From: Julien Cristau Date: Tue, 28 Oct 2014 10:30:04 +0100 Subject: render: check request size before reading it [CVE-2014-8100 1/2] Otherwise we may be reading outside of the client request. Signed-off-by: Julien Cristau Reviewed-by: Alan Coopersmith Signed-off-by: Alan Coopersmith --- render/render.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'render') diff --git a/render/render.c b/render/render.c index e3031da25..200e0c826 100644 --- a/render/render.c +++ b/render/render.c @@ -276,11 +276,11 @@ ProcRenderQueryVersion(ClientPtr client) REQUEST(xRenderQueryVersionReq); + REQUEST_SIZE_MATCH(xRenderQueryVersionReq); + pRenderClient->major_version = stuff->majorVersion; pRenderClient->minor_version = stuff->minorVersion; - REQUEST_SIZE_MATCH(xRenderQueryVersionReq); - if ((stuff->majorVersion * 1000 + stuff->minorVersion) < (SERVER_RENDER_MAJOR_VERSION * 1000 + SERVER_RENDER_MINOR_VERSION)) { rep.majorVersion = stuff->majorVersion; -- cgit v1.2.3