diff options
| author | Julien Cristau <jcristau@debian.org> | 2014-10-28 10:30:04 +0100 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2014-12-08 18:09:48 -0800 |
| commit | b5f9ef03df6a650571b29d3d1c1d2b67c6e84336 (patch) | |
| tree | b8394513d3b52c0472e0a4adc3a67edaa2d8c697 | |
| parent | 3df2fcf12499ebdb26b9b67419ea485a42041f33 (diff) | |
render: check request size before reading it [CVE-2014-8100 1/2]
Otherwise we may be reading outside of the client request.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
| -rw-r--r-- | render/render.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/render/render.c b/render/render.c index e3031da25..200e0c826 100644 --- a/render/render.c +++ b/render/render.c @@ -276,11 +276,11 @@ ProcRenderQueryVersion(ClientPtr client) REQUEST(xRenderQueryVersionReq); + REQUEST_SIZE_MATCH(xRenderQueryVersionReq); + pRenderClient->major_version = stuff->majorVersion; pRenderClient->minor_version = stuff->minorVersion; - REQUEST_SIZE_MATCH(xRenderQueryVersionReq); - if ((stuff->majorVersion * 1000 + stuff->minorVersion) < (SERVER_RENDER_MAJOR_VERSION * 1000 + SERVER_RENDER_MINOR_VERSION)) { rep.majorVersion = stuff->majorVersion; |