• Alan Coopersmith's avatar
    Xi: unvalidated lengths in Xinput extension [CVE-2014-8095] · fde1375e
    Alan Coopersmith authored
    Multiple functions in the Xinput extension handling of requests from
    clients failed to check that the length of the request sent by the
    client was large enough to perform all the required operations and
    thus could read or write to memory outside the bounds of the request
    buffer.
    
    This commit includes the creation of a new REQUEST_AT_LEAST_EXTRA_SIZE
    macro in include/dix.h for the common case of needing to ensure a
    request is large enough to include both the request itself and a
    minimum amount of extra data following the request header.
    
    v2: backport to nx-libs 3.6.x (Mike DePaulo)
    Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: 's avatarPeter Hutterer <peter.hutterer@who-t.net>
    
    Conflicts:
    	Xi/chgdctl.c
    	Xi/chgfctl.c
    	Xi/xiallowev.c
    	Xi/xichangecursor.c
    	Xi/xichangehierarchy.c
    	Xi/xigetclientpointer.c
    	Xi/xigrabdev.c
    	Xi/xipassivegrab.c
    	Xi/xiproperty.c
    	Xi/xiquerydevice.c
    	Xi/xiquerypointer.c
    	Xi/xiselectev.c
    	Xi/xisetclientpointer.c
    	Xi/xisetdevfocus.c
    	Xi/xiwarppointer.c
    
    [RHEL5: Xi/xi* files are XI2 ]
    fde1375e
chgdctl.c 6.67 KB