Skip to content

N
nx-libs
Commit 361d3677 authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Ulrich Sibiller
Browse files
Options

integer overflow in XGetWindowProperty() [CVE-2013-1981 10/13]

If the reported number of properties is too large, the calculations to allocate memory for them may overflow, leaving us returning less memory to the caller than implied by the value written to *nitems. Reported-by: 's avatarIlja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: 's avatarMatthieu Herrb <matthieu.herrb@laas.fr> Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 25172302
Hide whitespace changes
Inline Side-by-side
Showing with 16 additions and 9 deletions
nx-X11/lib/X11/GetProp.c
View file @ 361d3677
......@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
#include <config.h>
#endif
#include "Xlibint.h"
#include <limits.h>
int
XGetWindowProperty(
......@@ -66,8 +67,17 @@ XGetWindowProperty(
*prop = (unsigned char *) NULL;
if (reply.propertyType != None) {
long nbytes, netbytes;
switch (reply.format) {
unsigned long nbytes, netbytes;
int format = reply.format;
/*
* Protect against both integer overflow and just plain oversized
* memory allocation - no server should ever return this many props.
*/
if (reply.nItems >= (INT_MAX >> 4))
format = -1; /* fall through to default error case */
switch (format) {
/*
* One extra byte is malloced than is needed to contain the property
* data, but this last byte is null terminated and convenient for
......@@ -76,24 +86,21 @@ XGetWindowProperty(
*/
case 8:
nbytes = netbytes = reply.nItems;
if (nbytes + 1 > 0 &&
(*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)))
if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
_XReadPad (dpy, (char *) *prop, netbytes);
break;
case 16:
nbytes = reply.nItems * sizeof (short);
netbytes = reply.nItems << 1;
if (nbytes + 1 > 0 &&
(*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)))
if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
_XRead16Pad (dpy, (short *) *prop, netbytes);
break;
case 32:
nbytes = reply.nItems * sizeof (long);
netbytes = reply.nItems << 2;
if (nbytes + 1 > 0 &&
(*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)))
if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
_XRead32 (dpy, (long *) *prop, netbytes);
break;
......@@ -115,7 +122,7 @@ XGetWindowProperty(
break;
}
if (! *prop) {
_XEatData(dpy, (unsigned long) netbytes);
_XEatDataWords(dpy, reply.length);
UnlockDisplay(dpy);
SyncHandle();
return(BadAlloc); /* not Success */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment