CVE-2014-0209: integer overflow of realloc() size in lexAlias() from…

CVE-2014-0209: integer overflow of realloc() size in lexAlias() from xorg/lib/libXfont commit 05c8020a49416dd8b7510cbba45ce4f3fc81a7dc lexAlias() reads from a file in a loop. It does this by starting with a 64 byte buffer. If that size limit is hit, it does a realloc of the buffer size << 1, basically doubling the needed length every time the length limit is hit. Eventually, this will shift out to 0 (for a length of ~4gig), and that length will be passed on to realloc(). A length of 0 (with a valid pointer) causes realloc to free the buffer on most POSIX platforms, but the caller will still have a pointer to it, leading to use after free issues.

CVE-2014-0209: integer overflow of realloc() size in lexAlias() from…
36f1dae7 · Mike DePaulo · Mike Gabriel · f53f2474 · 36f1dae7
Commit 36f1dae7 authored Feb 08, 2015 by Mike DePaulo Committed by Mike Gabriel Feb 14, 2015
Show whitespace changes
Inline Side-by-side

Showing with 4 additions and 0 deletions

dirfile.c nx-X11/lib/font/fontfile/dirfile.c +4 -0

No files found.
--- a/nx-X11/lib/font/fontfile/dirfile.c
+++ b/nx-X11/lib/font/fontfile/dirfile.c
@@ -45,6 +45,7 @@ in this Software without prior written authorization from The Open Group.
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <errno.h>
+#include <limits.h>
 static Bool AddFileNameAliases ( FontDirectoryPtr dir );
 static int ReadFontAlias ( char *directory, Bool isFile,
@@ -373,6 +374,9 @@ lexAlias(FILE *file, char **lexToken)
 	    int         nsize;
 	    char       *nbuf;
+	    if (tokenSize >= (INT_MAX >> 2))
+		/* Stop before we overflow */
+		return EALLOC;
 	    nsize = tokenSize ? (tokenSize << 1) : 64;
 	    nbuf = (char *) xrealloc(tokenBuf, nsize);
 	    if (!nbuf)