CVE-2007-1003: XC-MISC Extension ProcXCMiscGetXIDList() Memory Corruption
This commit is contained in:
parent
f2808005f4
commit
645d87cf8e
@ -42,6 +42,12 @@ from The Open Group.
|
|||||||
#include <X11/extensions/xcmiscstr.h>
|
#include <X11/extensions/xcmiscstr.h>
|
||||||
#include "modinit.h"
|
#include "modinit.h"
|
||||||
|
|
||||||
|
#if HAVE_STDINT_H
|
||||||
|
#include <stdint.h>
|
||||||
|
#elif !defined(UINT32_MAX)
|
||||||
|
#define UINT32_MAX 0xffffffffU
|
||||||
|
#endif
|
||||||
|
|
||||||
#if 0
|
#if 0
|
||||||
static unsigned char XCMiscCode;
|
static unsigned char XCMiscCode;
|
||||||
#endif
|
#endif
|
||||||
@ -143,7 +149,10 @@ ProcXCMiscGetXIDList(client)
|
|||||||
|
|
||||||
REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
|
REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
|
||||||
|
|
||||||
pids = (XID *)ALLOCATE_LOCAL(stuff->count * sizeof(XID));
|
if (stuff->count > UINT32_MAX / sizeof(XID))
|
||||||
|
return BadAlloc;
|
||||||
|
|
||||||
|
pids = (XID *)Xalloc(stuff->count * sizeof(XID));
|
||||||
if (!pids)
|
if (!pids)
|
||||||
{
|
{
|
||||||
return BadAlloc;
|
return BadAlloc;
|
||||||
@ -164,7 +173,7 @@ ProcXCMiscGetXIDList(client)
|
|||||||
client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
|
client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
|
||||||
WriteSwappedDataToClient(client, count * sizeof(XID), pids);
|
WriteSwappedDataToClient(client, count * sizeof(XID), pids);
|
||||||
}
|
}
|
||||||
DEALLOCATE_LOCAL(pids);
|
Xfree(pids);
|
||||||
return(client->noClientException);
|
return(client->noClientException);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user