Skip to content

N
nx-libs
Commit 306ca006 authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Ulrich Sibiller
Browse files
Options

integer overflow in XGetModifierMapping() [CVE-2013-1981 13/13]

Ensure that we don't underallocate when the server claims a very large reply Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: 's avatarMatthieu Herrb <matthieu.herrb@laas.fr> Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 748af521
Hide whitespace changes
Inline Side-by-side
Showing with 9 additions and 4 deletions
nx-X11/lib/X11/ModMap.c
View file @ 306ca006
......@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
#include <config.h>
#endif
#include "Xlibint.h"
#include <limits.h>
XModifierKeymap *
XGetModifierMapping(register Display *dpy)
......@@ -41,13 +42,17 @@ XGetModifierMapping(register Display *dpy)
GetEmptyReq(GetModifierMapping, req);
(void) _XReply (dpy, (xReply *)&rep, 0, xFalse);
nbytes = (unsigned long)rep.length << 2;
res = (XModifierKeymap *) Xmalloc(sizeof (XModifierKeymap));
if (res) res->modifiermap = (KeyCode *) Xmalloc ((unsigned) nbytes);
if (rep.length < (LONG_MAX >> 2)) {
nbytes = (unsigned long)rep.length << 2;
res = Xmalloc(sizeof (XModifierKeymap));
if (res)
res->modifiermap = Xmalloc (nbytes);
} else
res = NULL;
if ((! res) || (! res->modifiermap)) {
if (res) Xfree((char *) res);
res = (XModifierKeymap *) NULL;
_XEatData(dpy, nbytes);
_XEatDataWords(dpy, rep.length);
} else {
_XReadPad(dpy, (char *) res->modifiermap, (long) nbytes);
res->max_keypermod = rep.numKeyPerModifier;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment