diff options
| author | Nathan Kidd <nkidd@opentext.com> | 2015-01-09 09:57:23 -0500 |
|---|---|---|
| committer | Adam Jackson <ajax@redhat.com> | 2017-10-12 12:25:02 -0400 |
| commit | c206f36a4b6ecf2555ab2291c349ab7d7d0b02f5 (patch) | |
| tree | 897692571963c316a878fe68c0c922b4dcc7351b /Xext | |
| parent | e751722a7b0c5b595794e60b054ade0b3f6cdb4d (diff) | |
Unvalidated lengths
v2: Add overflow check and remove unnecessary check (Julien Cristau)
This addresses:
CVE-2017-12184 in XINERAMA
CVE-2017-12185 in MIT-SCREEN-SAVER
CVE-2017-12186 in X-Resource
CVE-2017-12187 in RENDER
Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Nathan Kidd <nkidd@opentext.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
(cherry picked from commit cad5a1050b7184d828aef9c1dd151c3ab649d37e)
Diffstat (limited to 'Xext')
| -rw-r--r-- | Xext/panoramiX.c | 3 | ||||
| -rw-r--r-- | Xext/saver.c | 2 | ||||
| -rw-r--r-- | Xext/xres.c | 4 | ||||
| -rw-r--r-- | Xext/xvdisp.c | 4 |
4 files changed, 10 insertions, 3 deletions
diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c index 209df292c..844ea49ce 100644 --- a/Xext/panoramiX.c +++ b/Xext/panoramiX.c @@ -988,10 +988,11 @@ ProcPanoramiXGetScreenSize(ClientPtr client) xPanoramiXGetScreenSizeReply rep; int rc; + REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq); + if (stuff->screen >= PanoramiXNumScreens) return BadMatch; - REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq); rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess); if (rc != Success) return rc; diff --git a/Xext/saver.c b/Xext/saver.c index 750b8b965..45ac4d2c9 100644 --- a/Xext/saver.c +++ b/Xext/saver.c @@ -1185,6 +1185,8 @@ ProcScreenSaverUnsetAttributes(ClientPtr client) PanoramiXRes *draw; int rc, i; + REQUEST_SIZE_MATCH(xScreenSaverUnsetAttributesReq); + rc = dixLookupResourceByClass((void **) &draw, stuff->drawable, XRC_DRAWABLE, client, DixWriteAccess); if (rc != Success) diff --git a/Xext/xres.c b/Xext/xres.c index ae779dfe8..bc54133d2 100644 --- a/Xext/xres.c +++ b/Xext/xres.c @@ -947,6 +947,8 @@ ProcXResQueryResourceBytes (ClientPtr client) ConstructResourceBytesCtx ctx; REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq); + if (stuff->numSpecs > UINT32_MAX / sizeof(ctx.specs[0])) + return BadLength; REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq, stuff->numSpecs * sizeof(ctx.specs[0])); @@ -1052,8 +1054,8 @@ SProcXResQueryResourceBytes (ClientPtr client) int c; xXResResourceIdSpec *specs = (void*) ((char*) stuff + sizeof(*stuff)); - swapl(&stuff->numSpecs); REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq); + swapl(&stuff->numSpecs); REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq, stuff->numSpecs * sizeof(specs[0])); diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c index 8a35b7b4e..4d412b857 100644 --- a/Xext/xvdisp.c +++ b/Xext/xvdisp.c @@ -1493,12 +1493,14 @@ XineramaXvShmPutImage(ClientPtr client) { REQUEST(xvShmPutImageReq); PanoramiXRes *draw, *gc, *port; - Bool send_event = stuff->send_event; + Bool send_event; Bool isRoot; int result, i, x, y; REQUEST_SIZE_MATCH(xvShmPutImageReq); + send_event = stuff->send_event; + result = dixLookupResourceByClass((void **) &draw, stuff->drawable, XRC_DRAWABLE, client, DixWriteAccess); if (result != Success) |