diff options
| author | Daniel Stone <daniel@fooishbar.org> | 2005-09-13 01:33:19 +0000 |
|---|---|---|
| committer | Daniel Stone <daniel@fooishbar.org> | 2005-09-13 01:33:19 +0000 |
| commit | c3d6799cee7ff8411b3a05a7ab7e2a9e80c95059 (patch) | |
| tree | 0afd730bf28bc833a2e7ba13070190448bf56bfa /exa | |
| parent | b290884719e18646326f0c2412c2494a07fe3cfd (diff) | |
Bug #594: CAN-2005-2495: Fix exploitable integer overflow in pixmap
creation, where we could create a far smaller pixmap than we thought,
allowing changes to arbitrary chunks of memory. (Søren Sandmann
Pedersen)
Diffstat (limited to 'exa')
| -rw-r--r-- | exa/exa.c | 3 | ||||
| -rw-r--r-- | exa/exa_accel.c | 3 | ||||
| -rw-r--r-- | exa/exa_migration.c | 3 |
3 files changed, 9 insertions, 0 deletions
@@ -376,6 +376,9 @@ exaCreatePixmap(ScreenPtr pScreen, int w, int h, int depth) ScrnInfoPtr pScrn = XF86SCRNINFO(pScreen); ExaScreenPriv(pScreen); + if (w > 32767 || h > 32767) + return NullPixmap; + if (!pScrn->vtSema || pExaScr->swappedOut) { pPixmap = pExaScr->SavedCreatePixmap(pScreen, w, h, depth); } else { diff --git a/exa/exa_accel.c b/exa/exa_accel.c index 92ff394e2..22f5edd37 100644 --- a/exa/exa_accel.c +++ b/exa/exa_accel.c @@ -376,6 +376,9 @@ exaCreatePixmap(ScreenPtr pScreen, int w, int h, int depth) ScrnInfoPtr pScrn = XF86SCRNINFO(pScreen); ExaScreenPriv(pScreen); + if (w > 32767 || h > 32767) + return NullPixmap; + if (!pScrn->vtSema || pExaScr->swappedOut) { pPixmap = pExaScr->SavedCreatePixmap(pScreen, w, h, depth); } else { diff --git a/exa/exa_migration.c b/exa/exa_migration.c index 92ff394e2..22f5edd37 100644 --- a/exa/exa_migration.c +++ b/exa/exa_migration.c @@ -376,6 +376,9 @@ exaCreatePixmap(ScreenPtr pScreen, int w, int h, int depth) ScrnInfoPtr pScrn = XF86SCRNINFO(pScreen); ExaScreenPriv(pScreen); + if (w > 32767 || h > 32767) + return NullPixmap; + if (!pScrn->vtSema || pExaScr->swappedOut) { pPixmap = pExaScr->SavedCreatePixmap(pScreen, w, h, depth); } else { |