diff options
| author | Adam Jackson <ajax@redhat.com> | 2014-11-10 12:13:46 -0500 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2014-12-08 18:09:50 -0800 |
| commit | 44ba149f28ece93c2fbfc9cc980588de5322dd4b (patch) | |
| tree | 36c9758b2a8139e79b771db30b20942ec44bdb0a | |
| parent | afe177020d1fb776c6163f21eddc82cb185b95ca (diff) | |
glx: Length-checking for non-generated vendor private requests [CVE-2014-8098 6/8]
Reviewed-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Michal Srb <msrb@suse.com>
Reviewed-by: Andy Ritger <aritger@nvidia.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
| -rw-r--r-- | glx/indirect_program.c | 2 | ||||
| -rw-r--r-- | glx/swap_interval.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/glx/indirect_program.c b/glx/indirect_program.c index cda139ee6..5caee7b2a 100644 --- a/glx/indirect_program.c +++ b/glx/indirect_program.c @@ -56,6 +56,8 @@ DoGetProgramString(struct __GLXclientStateRec *cl, GLbyte * pc, __GLXcontext *const cx = __glXForceCurrent(cl, req->contextTag, &error); ClientPtr client = cl->client; + REQUEST_FIXED_SIZE(xGLXVendorPrivateWithReplyReq, 8); + pc += __GLX_VENDPRIV_HDR_SIZE; if (cx != NULL) { GLenum target; diff --git a/glx/swap_interval.c b/glx/swap_interval.c index 17bc99207..232055080 100644 --- a/glx/swap_interval.c +++ b/glx/swap_interval.c @@ -46,6 +46,8 @@ DoSwapInterval(__GLXclientState * cl, GLbyte * pc, int do_swap) __GLXcontext *cx; GLint interval; + REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 4); + cx = __glXLookupContextByTag(cl, tag); if ((cx == NULL) || (cx->pGlxScreen == NULL)) { |