glx: Request length checks for SetClientInfoARB [CVE-2014-8098 5/8]
Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
This commit is contained in:
parent
c91e4abc3b
commit
afe177020d
|
@ -33,18 +33,21 @@ static int
|
|||
set_client_info(__GLXclientState * cl, xGLXSetClientInfoARBReq * req,
|
||||
unsigned bytes_per_version)
|
||||
{
|
||||
ClientPtr client = cl->client;
|
||||
char *gl_extensions;
|
||||
char *glx_extensions;
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
|
||||
|
||||
/* Verify that the size of the packet matches the size inferred from the
|
||||
* sizes specified for the various fields.
|
||||
*/
|
||||
const unsigned expected_size = sz_xGLXSetClientInfoARBReq
|
||||
+ (req->numVersions * bytes_per_version)
|
||||
+ __GLX_PAD(req->numGLExtensionBytes)
|
||||
+ __GLX_PAD(req->numGLXExtensionBytes);
|
||||
int size = sz_xGLXSetClientInfoARBReq;
|
||||
size = safe_add(size, safe_mul(req->numVersions, bytes_per_version));
|
||||
size = safe_add(size, safe_pad(req->numGLExtensionBytes));
|
||||
size = safe_add(size, safe_pad(req->numGLXExtensionBytes));
|
||||
|
||||
if (req->length != (expected_size / 4))
|
||||
if (size < 0 || req->length != (size / 4))
|
||||
return BadLength;
|
||||
|
||||
/* Verify that the actual length of the GL extension string matches what's
|
||||
|
@ -80,8 +83,11 @@ __glXDisp_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
|
|||
int
|
||||
__glXDispSwap_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
|
||||
{
|
||||
ClientPtr client = cl->client;
|
||||
xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
|
||||
|
||||
req->length = bswap_16(req->length);
|
||||
req->numVersions = bswap_32(req->numVersions);
|
||||
req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
|
||||
|
@ -99,8 +105,11 @@ __glXDisp_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
|
|||
int
|
||||
__glXDispSwap_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
|
||||
{
|
||||
ClientPtr client = cl->client;
|
||||
xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
|
||||
|
||||
req->length = bswap_16(req->length);
|
||||
req->numVersions = bswap_32(req->numVersions);
|
||||
req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
|
||||
|
|
Loading…
Reference in New Issue