hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-21 01:13:38 +00:00
Code Issues Projects Releases Wiki Activity

Bug #594: CAN-2005-2495: Fix exploitable integer overflow in pixmap

Browse source 
creation, where we could create a far smaller pixmap than we thought,
    allowing changes to arbitrary chunks of memory. (Søren Sandmann
    Pedersen)
This commit is contained in:
Daniel Stone 2005-09-13 01:33:19 +00:00
commit c3d6799cee
16 changed files with 73 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

6
iplan2p4/iplpixmap.c
View file

@ -78,12 +78,14 @@ iplCreatePixmap (pScreen, width, height, depth)
int depth;
{
PixmapPtr pPixmap;
int datasize;
int paddedWidth;
size_t datasize;
size_t paddedWidth;
int ipad=INTER_PLANES*2 - 1;
paddedWidth = PixmapBytePad(width, depth);
paddedWidth = (paddedWidth + ipad) & ~ipad;
if (paddedWidth / 4 > 32767 || height > 32767)
return NullPixmap;
datasize = height * paddedWidth;
pPixmap = AllocatePixmap(pScreen, datasize);
if (!pPixmap)