diff options
| author | Adam Jackson <ajax@redhat.com> | 2014-11-10 12:13:46 -0500 |
|---|---|---|
| committer | Julien Cristau <jcristau@debian.org> | 2014-12-09 17:50:13 +0100 |
| commit | 44ed4a6547136a0945cd85f93b83392cf53f58f2 (patch) | |
| tree | b2be3e0ed1fe58e6f34737fe3efd77ec22220619 | |
| parent | fe9672204ad9edc09c4ae6ba1b9e9de09ec98287 (diff) | |
glx: Length-checking for non-generated vendor private requests [CVE-2014-8098 6/8]
Reviewed-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Michal Srb <msrb@suse.com>
Reviewed-by: Andy Ritger <aritger@nvidia.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 44ba149f28ece93c2fbfc9cc980588de5322dd4b)
Signed-off-by: Julien Cristau <jcristau@debian.org>
| -rw-r--r-- | glx/indirect_program.c | 2 | ||||
| -rw-r--r-- | glx/swap_interval.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/glx/indirect_program.c b/glx/indirect_program.c index d503262c2..01562e619 100644 --- a/glx/indirect_program.c +++ b/glx/indirect_program.c @@ -56,6 +56,8 @@ DoGetProgramString(struct __GLXclientStateRec *cl, GLbyte * pc, __GLXcontext *const cx = __glXForceCurrent(cl, req->contextTag, &error); ClientPtr client = cl->client; + REQUEST_FIXED_SIZE(xGLXVendorPrivateWithReplyReq, 8); + pc += __GLX_VENDPRIV_HDR_SIZE; if (cx != NULL) { GLenum target; diff --git a/glx/swap_interval.c b/glx/swap_interval.c index 17bc99207..232055080 100644 --- a/glx/swap_interval.c +++ b/glx/swap_interval.c @@ -46,6 +46,8 @@ DoSwapInterval(__GLXclientState * cl, GLbyte * pc, int do_swap) __GLXcontext *cx; GLint interval; + REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 4); + cx = __glXLookupContextByTag(cl, tag); if ((cx == NULL) || (cx->pGlxScreen == NULL)) { |