diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-26 16:33:03 -0700 |
|---|---|---|
| committer | Ian Romanick <ian.d.romanick@intel.com> | 2013-05-31 11:51:30 -0700 |
| commit | 18973c7f0ff022165347fef9f980394565785284 (patch) | |
| tree | f41499d5d7335927df2b9fb689f40ce2d7755ce8 | |
| parent | ee30fd0ea0437ab930f85f5ed335a44edc3ef12e (diff) | |
integer overflow in XF86DRIGetClientDriverName() [CVE-2013-1993 2/2]
clientDriverNameLength is a CARD32 and needs to be bounds checked before
adding one to it to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.
NOTE: This is a candidate for stable release branches.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
(cherry picked from commit 306f630e676eb901789dd09a0f30d7e7fa941ebe)
| -rw-r--r-- | src/glx/XF86dri.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/glx/XF86dri.c b/src/glx/XF86dri.c index c7c80c1228..703620eda9 100644 --- a/src/glx/XF86dri.c +++ b/src/glx/XF86dri.c @@ -305,9 +305,11 @@ XF86DRIGetClientDriverName(Display * dpy, int screen, *ddxDriverPatchVersion = rep.ddxDriverPatchVersion; if (rep.length) { - if (! - (*clientDriverName = - (char *) Xcalloc(rep.clientDriverNameLength + 1, 1))) { + if (rep.clientDriverNameLength < INT_MAX) + *clientDriverName = (char *) Xcalloc(rep.clientDriverNameLength + 1, 1); + else + *clientDriverName = NULL; + if (*clientDriverName == NULL) { _XEatData(dpy, ((rep.clientDriverNameLength + 3) & ~3)); UnlockDisplay(dpy); SyncHandle(); |