andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Unvalidated lengths

Browse Source 
v2: Add overflow check and remove unnecessary check (Julien Cristau)

This addresses:
CVE-2017-12184 in XINERAMA
CVE-2017-12185 in MIT-SCREEN-SAVER
CVE-2017-12186 in X-Resource
CVE-2017-12187 in RENDER

Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Nathan Kidd <nkidd@opentext.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
This commit is contained in:
Nathan Kidd 2015-01-09 09:57:23 -05:00 committed by Julien Cristau
parent 9c23685009
commit cad5a1050b
7 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Xext/panoramiX.c
View File

@ -988,10 +988,11 @@ ProcPanoramiXGetScreenSize(ClientPtr client)
xPanoramiXGetScreenSizeReply rep; xPanoramiXGetScreenSizeReply rep;
int rc; int rc;
REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
if (stuff->screen >= PanoramiXNumScreens) if (stuff->screen >= PanoramiXNumScreens)
return BadMatch; return BadMatch;
REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess); rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess);
if (rc != Success) if (rc != Success)
return rc; return rc;

2
Xext/saver.c
View File

@ -1186,6 +1186,8 @@ ProcScreenSaverUnsetAttributes(ClientPtr client)
PanoramiXRes *draw; PanoramiXRes *draw;
int rc, i; int rc, i;
REQUEST_SIZE_MATCH(xScreenSaverUnsetAttributesReq);
rc = dixLookupResourceByClass((void **) &draw, stuff->drawable, rc = dixLookupResourceByClass((void **) &draw, stuff->drawable,
XRC_DRAWABLE, client, DixWriteAccess); XRC_DRAWABLE, client, DixWriteAccess);
if (rc != Success) if (rc != Success)

4
Xext/xres.c
View File

@ -947,6 +947,8 @@ ProcXResQueryResourceBytes (ClientPtr client)
ConstructResourceBytesCtx ctx; ConstructResourceBytesCtx ctx;
REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq); REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq);
if (stuff->numSpecs > UINT32_MAX / sizeof(ctx.specs[0]))
return BadLength;
REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq, REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq,
stuff->numSpecs * sizeof(ctx.specs[0])); stuff->numSpecs * sizeof(ctx.specs[0]));
@ -1052,8 +1054,8 @@ SProcXResQueryResourceBytes (ClientPtr client)
int c; int c;
xXResResourceIdSpec *specs = (void*) ((char*) stuff + sizeof(*stuff)); xXResResourceIdSpec *specs = (void*) ((char*) stuff + sizeof(*stuff));
swapl(&stuff->numSpecs);
REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq); REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq);
swapl(&stuff->numSpecs);
REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq, REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq,
stuff->numSpecs * sizeof(specs[0])); stuff->numSpecs * sizeof(specs[0]));

4
Xext/xvdisp.c
View File

@ -1493,12 +1493,14 @@ XineramaXvShmPutImage(ClientPtr client)
{ {
REQUEST(xvShmPutImageReq); REQUEST(xvShmPutImageReq);
PanoramiXRes *draw, *gc, *port; PanoramiXRes *draw, *gc, *port;
Bool send_event = stuff->send_event; Bool send_event;
Bool isRoot; Bool isRoot;
int result, i, x, y; int result, i, x, y;
REQUEST_SIZE_MATCH(xvShmPutImageReq); REQUEST_SIZE_MATCH(xvShmPutImageReq);
send_event = stuff->send_event;
result = dixLookupResourceByClass((void **) &draw, stuff->drawable, result = dixLookupResourceByClass((void **) &draw, stuff->drawable,
XRC_DRAWABLE, client, DixWriteAccess); XRC_DRAWABLE, client, DixWriteAccess);
if (result != Success) if (result != Success)

2
hw/dmx/dmxpict.c
View File

@ -716,6 +716,8 @@ dmxProcRenderSetPictureFilter(ClientPtr client)
filter = (char *) (stuff + 1); filter = (char *) (stuff + 1);
params = (XFixed *) (filter + ((stuff->nbytes + 3) & ~3)); params = (XFixed *) (filter + ((stuff->nbytes + 3) & ~3));
nparams = ((XFixed *) stuff + client->req_len) - params; nparams = ((XFixed *) stuff + client->req_len) - params;
if (nparams < 0)
return BadLength;
XRenderSetPictureFilter(dmxScreen->beDisplay, XRenderSetPictureFilter(dmxScreen->beDisplay,
pPictPriv->pict, filter, params, nparams); pPictPriv->pict, filter, params, nparams);

3
pseudoramiX/pseudoramiX.c
View File

@ -297,10 +297,11 @@ ProcPseudoramiXGetScreenSize(ClientPtr client)
TRACE; TRACE;
REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
if (stuff->screen >= pseudoramiXNumScreens) if (stuff->screen >= pseudoramiXNumScreens)
return BadMatch; return BadMatch;
REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess); rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess);
if (rc != Success) if (rc != Success)
return rc; return rc;

3
render/render.c
View File

@ -1757,6 +1757,9 @@ ProcRenderSetPictureFilter(ClientPtr client)
name = (char *) (stuff + 1); name = (char *) (stuff + 1);
params = (xFixed *) (name + pad_to_int32(stuff->nbytes)); params = (xFixed *) (name + pad_to_int32(stuff->nbytes));
nparams = ((xFixed *) stuff + client->req_len) - params; nparams = ((xFixed *) stuff + client->req_len) - params;
if (nparams < 0)
return BadLength;
result = SetPictureFilter(pPicture, name, stuff->nbytes, params, nparams); result = SetPictureFilter(pPicture, name, stuff->nbytes, params, nparams);
return result; return result;
} }