dix: integer overflow in ProcPutImage() [CVE-2014-8092 1/4]
ProcPutImage() calculates a length field from a width, left pad and depth specified by the client (if the specified format is XYPixmap). The calculations for the total amount of memory the server needs for the pixmap can overflow a 32-bit number, causing out-of-bounds memory writes on 32-bit systems (since the length is stored in a long int variable). Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
parent
90cc925c59
commit
eeae42d60b
|
@ -2000,6 +2000,9 @@ ProcPutImage(ClientPtr client)
|
|||
tmpImage = (char *) &stuff[1];
|
||||
lengthProto = length;
|
||||
|
||||
if (lengthProto >= (INT32_MAX / stuff->height))
|
||||
return BadLength;
|
||||
|
||||
if ((bytes_to_int32(lengthProto * stuff->height) +
|
||||
bytes_to_int32(sizeof(xPutImageReq))) != client->req_len)
|
||||
return BadLength;
|
||||
|
|
Loading…
Reference in New Issue
Block a user