CVE-2008-2362 - RENDER Extension memory corruption
Integer overflows can occur in the code validating the parameters for the SProcRenderCreateLinearGradient, SProcRenderCreateRadialGradient and SProcRenderCreateConicalGradient functions, leading to memory corruption by swapping bytes outside of the intended request parameters.
This commit is contained in:
parent
5677751a04
commit
a1733327aa
@ -1996,6 +1996,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
|
||||
LEGAL_NEW_RESOURCE(stuff->pid, client);
|
||||
|
||||
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
|
||||
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
|
||||
return BadLength;
|
||||
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
|
||||
return BadLength;
|
||||
|
||||
@ -2584,18 +2586,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
|
||||
return (*ProcRenderVector[stuff->renderReqType]) (client);
|
||||
}
|
||||
|
||||
static void swapStops(void *stuff, int n)
|
||||
static void swapStops(void *stuff, int num)
|
||||
{
|
||||
int i;
|
||||
int i, n;
|
||||
CARD32 *stops;
|
||||
CARD16 *colors;
|
||||
stops = (CARD32 *)(stuff);
|
||||
for (i = 0; i < n; ++i) {
|
||||
for (i = 0; i < num; ++i) {
|
||||
swapl(stops, n);
|
||||
++stops;
|
||||
}
|
||||
colors = (CARD16 *)(stops);
|
||||
for (i = 0; i < 4*n; ++i) {
|
||||
for (i = 0; i < 4*num; ++i) {
|
||||
swaps(stops, n);
|
||||
++stops;
|
||||
}
|
||||
@ -2618,6 +2620,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
|
||||
swapl(&stuff->nStops, n);
|
||||
|
||||
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
|
||||
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
|
||||
return BadLength;
|
||||
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
|
||||
return BadLength;
|
||||
|
||||
@ -2645,6 +2649,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
|
||||
swapl(&stuff->nStops, n);
|
||||
|
||||
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
|
||||
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
|
||||
return BadLength;
|
||||
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
|
||||
return BadLength;
|
||||
|
||||
@ -2669,6 +2675,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
|
||||
swapl(&stuff->nStops, n);
|
||||
|
||||
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
|
||||
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
|
||||
return BadLength;
|
||||
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
|
||||
return BadLength;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user