Skip to content

N
nx-libs
Commit 0445730b authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Ulrich Sibiller
Browse files
Options

unvalidated indexes in _XkbReadGeomShapes() [CVE-2013-1997 3/15]

If the X server returns shape indexes outside the range of the number of shapes it told us to allocate, out of bounds memory access could occur. Reported-by: 's avatarIlja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: 's avatarMatthieu Herrb <matthieu.herrb@laas.fr> Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent b0695260
Hide whitespace changes
Inline Side-by-side
Showing with 8 additions and 4 deletions
nx-X11/lib/X11/XKBGeom.c
View file @ 0445730b
......@@ -364,12 +364,16 @@ Status rtrn;
}
ol->num_points= olWire->nPoints;
}
if (shapeWire->primaryNdx!=XkbNoShape)
if ((shapeWire->primaryNdx!=XkbNoShape) &&
(shapeWire->primaryNdx < shapeWire->nOutlines))
shape->primary= &shape->outlines[shapeWire->primaryNdx];
else shape->primary= NULL;
if (shapeWire->approxNdx!=XkbNoShape)
else
shape->primary= NULL;
if ((shapeWire->approxNdx!=XkbNoShape) &&
(shapeWire->approxNdx < shapeWire->nOutlines))
shape->approx= &shape->outlines[shapeWire->approxNdx];
else shape->approx= NULL;
else
shape->approx= NULL;
XkbComputeShapeBounds(shape);
}
return Success;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment