|
 |
fa5c65 |
From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001
|
|
|
fa5c65 |
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
fa5c65 |
Date: Wed, 1 May 2013 17:59:31 -0700
|
|
|
fa5c65 |
Subject: [PATCH] integer overflow in read_packet() [CVE-2013-2064]
|
|
|
fa5c65 |
|
|
|
fa5c65 |
Ensure that when calculating the size of the incoming response from the
|
|
|
fa5c65 |
Xserver, we don't overflow the integer used in the calculations when we
|
|
|
fa5c65 |
multiply the int32_t length by 4 and add it to the default response size.
|
|
|
fa5c65 |
|
|
|
fa5c65 |
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
fa5c65 |
---
|
|
|
fa5c65 |
src/xcb_in.c | 13 +++++++++----
|
|
|
fa5c65 |
1 file changed, 9 insertions(+), 4 deletions(-)
|
|
|
fa5c65 |
|
|
|
fa5c65 |
diff --git a/src/xcb_in.c b/src/xcb_in.c
|
|
|
fa5c65 |
index b810783..8a7af92 100644
|
|
|
fa5c65 |
--- a/src/xcb_in.c
|
|
|
fa5c65 |
+++ b/src/xcb_in.c
|
|
|
fa5c65 |
@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
|
|
|
fa5c65 |
static int read_packet(xcb_connection_t *c)
|
|
|
fa5c65 |
{
|
|
|
fa5c65 |
xcb_generic_reply_t genrep;
|
|
|
fa5c65 |
- int length = 32;
|
|
|
fa5c65 |
- int eventlength = 0; /* length after first 32 bytes for GenericEvents */
|
|
|
fa5c65 |
+ uint64_t length = 32;
|
|
|
fa5c65 |
+ uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
|
|
|
fa5c65 |
+ uint64_t bufsize;
|
|
|
fa5c65 |
void *buf;
|
|
|
fa5c65 |
pending_reply *pend = 0;
|
|
|
fa5c65 |
struct event_list *event;
|
|
|
fa5c65 |
@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
|
|
|
fa5c65 |
if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
|
|
|
fa5c65 |
eventlength = genrep.length * 4;
|
|
|
fa5c65 |
|
|
|
fa5c65 |
- buf = malloc(length + eventlength +
|
|
|
fa5c65 |
- (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
|
|
|
fa5c65 |
+ bufsize = length + eventlength +
|
|
|
fa5c65 |
+ (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
|
|
|
fa5c65 |
+ if (bufsize < INT32_MAX)
|
|
|
fa5c65 |
+ buf = malloc((size_t) bufsize);
|
|
|
fa5c65 |
+ else
|
|
|
fa5c65 |
+ buf = NULL;
|
|
|
fa5c65 |
if(!buf)
|
|
|
fa5c65 |
{
|
|
|
fa5c65 |
_xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);
|
|
|
fa5c65 |
--
|
|
|
fa5c65 |
1.8.1.4
|
|
|
fa5c65 |
|