hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-03 03:24:39 +00:00
Code Issues Projects Releases Wiki Activity

dix: integer overflow in RegionSizeof() [CVE-2014-8092 3/4]

Browse source 
RegionSizeof contains several integer overflows if a large length
value is passed in.  Once we fix it to return 0 on overflow, we
also have to fix the callers to handle this error condition

v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
This commit is contained in:
Alan Coopersmith 2014-01-22 22:37:15 -08:00
commit 97015a07b9
2 changed files with 20 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

10
include/regionstr.h
View file

@ -127,7 +127,10 @@ RegionEnd(RegionPtr reg)
static inline size_t
RegionSizeof(size_t n)
{
return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
if (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec)))
return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
else
return 0;
}
static inline void
@ -138,9 +141,10 @@ RegionInit(RegionPtr _pReg, BoxPtr _rect, int _size)
(_pReg)->data = (RegDataPtr) NULL;
}
else {
size_t rgnSize;
(_pReg)->extents = RegionEmptyBox;
if (((_size) > 1) && ((_pReg)->data =
(RegDataPtr) malloc(RegionSizeof(_size)))) {
if (((_size) > 1) && ((rgnSize = RegionSizeof(_size)) > 0) &&
(((_pReg)->data = malloc(rgnSize)) != NULL)) {
(_pReg)->data->size = (_size);
(_pReg)->data->numRects = 0;
}