andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

CVE-2007-1003: XC-MISC Extension ProcXCMiscGetXIDList() Memory Corruption

Browse Source
This commit is contained in:
Matthieu Herrb 2007-04-03 15:47:18 +02:00
parent f2808005f4
commit 645d87cf8e
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Xext/xcmisc.c
View File

@ -42,6 +42,12 @@ from The Open Group.
#include <X11/extensions/xcmiscstr.h>
#include "modinit.h"
#if HAVE_STDINT_H
#include <stdint.h>
#elif !defined(UINT32_MAX)
#define UINT32_MAX 0xffffffffU
#endif
#if 0
static unsigned char XCMiscCode;
#endif
@ -143,7 +149,10 @@ ProcXCMiscGetXIDList(client)
REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
pids = (XID *)ALLOCATE_LOCAL(stuff->count * sizeof(XID));
if (stuff->count > UINT32_MAX / sizeof(XID))
return BadAlloc;
pids = (XID *)Xalloc(stuff->count * sizeof(XID));
if (!pids)
{
return BadAlloc;
@ -164,7 +173,7 @@ ProcXCMiscGetXIDList(client)
client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
WriteSwappedDataToClient(client, count * sizeof(XID), pids);
}
DEALLOCATE_LOCAL(pids);
Xfree(pids);
return(client->noClientException);
}