andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

CVE-2008-1377 - RECORD and Security extensions memory corruption

Browse Source 
Lack of validation of the parameters of the
SProcSecurityGenerateAuthorization SProcRecordCreateContext
functions makes it possible for a specially crafted request to trigger
the swapping of bytes outside the parameter of these requests, causing
memory corruption.
This commit is contained in:
Matthieu Herrb 2008-06-08 11:16:55 -06:00 committed by Matthieu Herrb
parent 702e709973
commit 8ffaf61370
2 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Xext/security.c
View File

@ -651,15 +651,19 @@ SProcSecurityGenerateAuthorization(
register char n;
CARD32 *values;
unsigned long nvalues;
int values_offset;
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xSecurityGenerateAuthorizationReq);
swaps(&stuff->nbytesAuthProto, n);
swaps(&stuff->nbytesAuthData, n);
swapl(&stuff->valueMask, n);
values = (CARD32 *)(&stuff[1]) +
((stuff->nbytesAuthProto + (unsigned)3) >> 2) +
((stuff->nbytesAuthData + (unsigned)3) >> 2);
values_offset = ((stuff->nbytesAuthProto + (unsigned)3) >> 2) +
((stuff->nbytesAuthData + (unsigned)3) >> 2);
if (values_offset >
stuff->length - (sz_xSecurityGenerateAuthorizationReq >> 2))
return BadLength;
values = (CARD32 *)(&stuff[1]) + values_offset;
nvalues = (((CARD32 *)stuff) + stuff->length) - values;
SwapLongs(values, nvalues);
return ProcSecurityGenerateAuthorization(client);

16
record/record.c
View File

@ -2656,7 +2656,7 @@ SProcRecordQueryVersion(ClientPtr client)
} /* SProcRecordQueryVersion */
static void
static int
SwapCreateRegister(xRecordRegisterClientsReq *stuff)
{
register char n;
@ -2667,11 +2667,17 @@ SwapCreateRegister(xRecordRegisterClientsReq *stuff)
swapl(&stuff->nClients, n);
swapl(&stuff->nRanges, n);
pClientID = (XID *)&stuff[1];
if (stuff->nClients > stuff->length - (sz_xRecordRegisterClientsReq >> 2))
return BadLength;
for (i = 0; i < stuff->nClients; i++, pClientID++)
{
swapl(pClientID, n);
}
if (stuff->nRanges > stuff->length - (sz_xRecordRegisterClientsReq >> 2)
- stuff->nClients)
return BadLength;
RecordSwapRanges((xRecordRange *)pClientID, stuff->nRanges);
return Success;
} /* SwapCreateRegister */
@ -2679,11 +2685,13 @@ static int
SProcRecordCreateContext(ClientPtr client)
{
REQUEST(xRecordCreateContextReq);
int status;
register char n;
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xRecordCreateContextReq);
SwapCreateRegister((pointer)stuff);
if ((status = SwapCreateRegister((pointer)stuff)) != Success)
return status;
return ProcRecordCreateContext(client);
} /* SProcRecordCreateContext */
@ -2692,11 +2700,13 @@ static int
SProcRecordRegisterClients(ClientPtr client)
{
REQUEST(xRecordRegisterClientsReq);
int status;
register char n;
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xRecordRegisterClientsReq);
SwapCreateRegister((pointer)stuff);
if ((status = SwapCreateRegister((pointer)stuff)) != Success)
return status;
return ProcRecordRegisterClients(client);
} /* SProcRecordRegisterClients */