hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-14 00:01:20 +00:00
Code Issues Projects Releases Wiki Activity

Bug #594: CAN-2005-2495: Fix exploitable integer overflow in pixmap

Browse source 
creation, where we could create a far smaller pixmap than we thought,
    allowing changes to arbitrary chunks of memory. (Søren Sandmann
    Pedersen)
This commit is contained in:
Daniel Stone 2005-09-13 01:33:19 +00:00
commit c3d6799cee
16 changed files with 73 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
afb/afbpixmap.c
View file

@ -77,10 +77,14 @@ afbCreatePixmap(pScreen, width, height, depth)
int depth;
{
PixmapPtr pPixmap;
int datasize;
int paddedWidth;
size_t datasize;
size_t paddedWidth;
paddedWidth = BitmapBytePad(width);
if (paddedWidth > 32767 || height > 32767 || depth > 4)
return NullPixmap;
datasize = height * paddedWidth * depth;
pPixmap = AllocatePixmap(pScreen, datasize);
if (!pPixmap)