Xv: unvalidated lengths in XVideo extension swapped procs [CVE-2014-8099]
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
parent
7553082b9b
commit
32a95fb7c7
|
@ -1121,6 +1121,7 @@ static int
|
||||||
SProcXvQueryExtension(ClientPtr client)
|
SProcXvQueryExtension(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvQueryExtensionReq);
|
REQUEST(xvQueryExtensionReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvQueryExtensionReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
return XvProcVector[xv_QueryExtension] (client);
|
return XvProcVector[xv_QueryExtension] (client);
|
||||||
}
|
}
|
||||||
|
@ -1129,6 +1130,7 @@ static int
|
||||||
SProcXvQueryAdaptors(ClientPtr client)
|
SProcXvQueryAdaptors(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvQueryAdaptorsReq);
|
REQUEST(xvQueryAdaptorsReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvQueryAdaptorsReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->window);
|
swapl(&stuff->window);
|
||||||
return XvProcVector[xv_QueryAdaptors] (client);
|
return XvProcVector[xv_QueryAdaptors] (client);
|
||||||
|
@ -1138,6 +1140,7 @@ static int
|
||||||
SProcXvQueryEncodings(ClientPtr client)
|
SProcXvQueryEncodings(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvQueryEncodingsReq);
|
REQUEST(xvQueryEncodingsReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvQueryEncodingsReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
return XvProcVector[xv_QueryEncodings] (client);
|
return XvProcVector[xv_QueryEncodings] (client);
|
||||||
|
@ -1147,6 +1150,7 @@ static int
|
||||||
SProcXvGrabPort(ClientPtr client)
|
SProcXvGrabPort(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvGrabPortReq);
|
REQUEST(xvGrabPortReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvGrabPortReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->time);
|
swapl(&stuff->time);
|
||||||
|
@ -1157,6 +1161,7 @@ static int
|
||||||
SProcXvUngrabPort(ClientPtr client)
|
SProcXvUngrabPort(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvUngrabPortReq);
|
REQUEST(xvUngrabPortReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvUngrabPortReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->time);
|
swapl(&stuff->time);
|
||||||
|
@ -1167,6 +1172,7 @@ static int
|
||||||
SProcXvPutVideo(ClientPtr client)
|
SProcXvPutVideo(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvPutVideoReq);
|
REQUEST(xvPutVideoReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvPutVideoReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->drawable);
|
swapl(&stuff->drawable);
|
||||||
|
@ -1186,6 +1192,7 @@ static int
|
||||||
SProcXvPutStill(ClientPtr client)
|
SProcXvPutStill(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvPutStillReq);
|
REQUEST(xvPutStillReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvPutStillReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->drawable);
|
swapl(&stuff->drawable);
|
||||||
|
@ -1205,6 +1212,7 @@ static int
|
||||||
SProcXvGetVideo(ClientPtr client)
|
SProcXvGetVideo(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvGetVideoReq);
|
REQUEST(xvGetVideoReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvGetVideoReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->drawable);
|
swapl(&stuff->drawable);
|
||||||
|
@ -1224,6 +1232,7 @@ static int
|
||||||
SProcXvGetStill(ClientPtr client)
|
SProcXvGetStill(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvGetStillReq);
|
REQUEST(xvGetStillReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvGetStillReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->drawable);
|
swapl(&stuff->drawable);
|
||||||
|
@ -1243,6 +1252,7 @@ static int
|
||||||
SProcXvPutImage(ClientPtr client)
|
SProcXvPutImage(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvPutImageReq);
|
REQUEST(xvPutImageReq);
|
||||||
|
REQUEST_AT_LEAST_SIZE(xvPutImageReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->drawable);
|
swapl(&stuff->drawable);
|
||||||
|
@ -1266,6 +1276,7 @@ static int
|
||||||
SProcXvShmPutImage(ClientPtr client)
|
SProcXvShmPutImage(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvShmPutImageReq);
|
REQUEST(xvShmPutImageReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvShmPutImageReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->drawable);
|
swapl(&stuff->drawable);
|
||||||
|
@ -1293,6 +1304,7 @@ static int
|
||||||
SProcXvSelectVideoNotify(ClientPtr client)
|
SProcXvSelectVideoNotify(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvSelectVideoNotifyReq);
|
REQUEST(xvSelectVideoNotifyReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvSelectVideoNotifyReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->drawable);
|
swapl(&stuff->drawable);
|
||||||
return XvProcVector[xv_SelectVideoNotify] (client);
|
return XvProcVector[xv_SelectVideoNotify] (client);
|
||||||
|
@ -1302,6 +1314,7 @@ static int
|
||||||
SProcXvSelectPortNotify(ClientPtr client)
|
SProcXvSelectPortNotify(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvSelectPortNotifyReq);
|
REQUEST(xvSelectPortNotifyReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvSelectPortNotifyReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
return XvProcVector[xv_SelectPortNotify] (client);
|
return XvProcVector[xv_SelectPortNotify] (client);
|
||||||
|
@ -1311,6 +1324,7 @@ static int
|
||||||
SProcXvStopVideo(ClientPtr client)
|
SProcXvStopVideo(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvStopVideoReq);
|
REQUEST(xvStopVideoReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvStopVideoReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->drawable);
|
swapl(&stuff->drawable);
|
||||||
|
@ -1321,6 +1335,7 @@ static int
|
||||||
SProcXvSetPortAttribute(ClientPtr client)
|
SProcXvSetPortAttribute(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvSetPortAttributeReq);
|
REQUEST(xvSetPortAttributeReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvSetPortAttributeReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->attribute);
|
swapl(&stuff->attribute);
|
||||||
|
@ -1332,6 +1347,7 @@ static int
|
||||||
SProcXvGetPortAttribute(ClientPtr client)
|
SProcXvGetPortAttribute(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvGetPortAttributeReq);
|
REQUEST(xvGetPortAttributeReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvGetPortAttributeReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->attribute);
|
swapl(&stuff->attribute);
|
||||||
|
@ -1342,6 +1358,7 @@ static int
|
||||||
SProcXvQueryBestSize(ClientPtr client)
|
SProcXvQueryBestSize(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvQueryBestSizeReq);
|
REQUEST(xvQueryBestSizeReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvQueryBestSizeReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swaps(&stuff->vid_w);
|
swaps(&stuff->vid_w);
|
||||||
|
@ -1355,6 +1372,7 @@ static int
|
||||||
SProcXvQueryPortAttributes(ClientPtr client)
|
SProcXvQueryPortAttributes(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvQueryPortAttributesReq);
|
REQUEST(xvQueryPortAttributesReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvQueryPortAttributesReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
return XvProcVector[xv_QueryPortAttributes] (client);
|
return XvProcVector[xv_QueryPortAttributes] (client);
|
||||||
|
@ -1364,6 +1382,7 @@ static int
|
||||||
SProcXvQueryImageAttributes(ClientPtr client)
|
SProcXvQueryImageAttributes(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvQueryImageAttributesReq);
|
REQUEST(xvQueryImageAttributesReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvQueryImageAttributesReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
swapl(&stuff->id);
|
swapl(&stuff->id);
|
||||||
|
@ -1376,6 +1395,7 @@ static int
|
||||||
SProcXvListImageFormats(ClientPtr client)
|
SProcXvListImageFormats(ClientPtr client)
|
||||||
{
|
{
|
||||||
REQUEST(xvListImageFormatsReq);
|
REQUEST(xvListImageFormatsReq);
|
||||||
|
REQUEST_SIZE_MATCH(xvListImageFormatsReq);
|
||||||
swaps(&stuff->length);
|
swaps(&stuff->length);
|
||||||
swapl(&stuff->port);
|
swapl(&stuff->port);
|
||||||
return XvProcVector[xv_ListImageFormats] (client);
|
return XvProcVector[xv_ListImageFormats] (client);
|
||||||
|
|
Loading…
Reference in New Issue
Block a user