hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-01 22:03:09 +00:00
Code Issues Projects Releases Wiki Activity

Bug #594: CAN-2005-2495: Fix exploitable integer overflow in pixmap

Browse source 
creation, where we could create a far smaller pixmap than we thought,
    allowing changes to arbitrary chunks of memory. (Søren Sandmann
    Pedersen)
This commit is contained in:
Daniel Stone 2005-09-13 01:33:19 +00:00
commit c3d6799cee
16 changed files with 73 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hw/xfree86/exa/exa.c
View file

@ -376,6 +376,9 @@ exaCreatePixmap(ScreenPtr pScreen, int w, int h, int depth)
ScrnInfoPtr pScrn = XF86SCRNINFO(pScreen);
ExaScreenPriv(pScreen);
if (w > 32767 || h > 32767)
return NullPixmap;
if (!pScrn->vtSema || pExaScr->swappedOut) {
pPixmap = pExaScr->SavedCreatePixmap(pScreen, w, h, depth);
} else {

3
hw/xfree86/exa/exa_accel.c
View file

@ -376,6 +376,9 @@ exaCreatePixmap(ScreenPtr pScreen, int w, int h, int depth)
ScrnInfoPtr pScrn = XF86SCRNINFO(pScreen);
ExaScreenPriv(pScreen);
if (w > 32767 || h > 32767)
return NullPixmap;
if (!pScrn->vtSema || pExaScr->swappedOut) {
pPixmap = pExaScr->SavedCreatePixmap(pScreen, w, h, depth);
} else {

3
hw/xfree86/exa/exa_migration.c
View file

@ -376,6 +376,9 @@ exaCreatePixmap(ScreenPtr pScreen, int w, int h, int depth)
ScrnInfoPtr pScrn = XF86SCRNINFO(pScreen);
ExaScreenPriv(pScreen);
if (w > 32767 || h > 32767)
return NullPixmap;
if (!pScrn->vtSema || pExaScr->swappedOut) {
pPixmap = pExaScr->SavedCreatePixmap(pScreen, w, h, depth);
} else {