__glXDisp_CreateContextAttribsARB() computed
expected_size = (sizeof(req) + req->numAttribs * 8) / 4
in 32-bit unsigned arithmetic with no clamp on the attacker-controlled
numAttribs. A value such as 0x20000000 makes numAttribs * 8 wrap to 0, so a
minimal 28-byte request satisfies "req->length != expected_size", after which
the loop "for (i = 0; i < req->numAttribs; i++)" reads attribs[i*2] far past
the end of the request buffer (out-of-bounds read / crash).
Add the same "numAttribs > (UINT32_MAX >> 3)" clamp the other GLX context
handlers already use before the size computation.
Fixes: b840ba5f54 ("glx: Implement protocol for glXCreateContextAttribsARB")
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
