From 5257a0f83d5f3d80d0cd44dd76d047bac3869592 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu.herrb@laas.fr>
Date: Tue, 10 Jun 2008 12:22:30 -0600
Subject: CVE-2008-2361 - RENDER Extension crash

An integer overflow may occur in the computation of the size of the
glyph to be allocated by the ProcRenderCreateCursor() function which
will cause less memory to be allocated than expected, leading later to
dereferencing un-mapped memory, causing a crash of the X server.
---
 render/render.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/render/render.c b/render/render.c
index 16b8eb3c3..7787e18ae 100644
--- a/render/render.c
+++ b/render/render.c
@@ -1569,6 +1569,8 @@ ProcRenderCreateCursor (ClientPtr client)
     pScreen = pSrc->pDrawable->pScreen;
     width = pSrc->pDrawable->width;
     height = pSrc->pDrawable->height;
+    if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+	return BadAlloc;
     if ( stuff->x > width 
       || stuff->y > height )
 	return (BadMatch);
-- 
cgit v1.2.3