Xserver/Xext/saver.c Unvalidated lengths (X.org CVE-2017-12185).

commit cad5a1050b7184d828aef9c1dd151c3ab649d37e Author: Nathan Kidd <nkidd@opentext.com> Date: Fri Jan 9 09:57:23 2015 -0500 Unvalidated lengths v2: Add overflow check and remove unnecessary check (Julien Cristau) This addresses: CVE-2017-12184 in XINERAMA CVE-2017-12185 in MIT-SCREEN-SAVER CVE-2017-12186 in X-Resource CVE-2017-12187 in RENDER Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Nathan Kidd <nkidd@opentext.com> Signed-off-by: Julien Cristau <jcristau@debian.org> Backported-to-NX-by: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Xserver/Xext/saver.c Unvalidated lengths (X.org CVE-2017-12185).
7017c22c · Nathan Kidd · Mihai Moldovan · f3231601 · 7017c22c
Commit 7017c22c authored Mar 05, 2018 by Nathan Kidd Committed by Mihai Moldovan Mar 07, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

saver.c nx-X11/programs/Xserver/Xext/saver.c +2 -0

No files found.
--- a/nx-X11/programs/Xserver/Xext/saver.c
+++ b/nx-X11/programs/Xserver/Xext/saver.c
@@ -1342,6 +1342,8 @@ ProcScreenSaverUnsetAttributes (ClientPtr client)
       PanoramiXRes *draw;
       int i;

+       REQUEST_SIZE_MATCH(xScreenSaverUnsetAttributesReq);
+
       if(!(draw = (PanoramiXRes *)SecurityLookupIDByClass(
                   client, stuff->drawable, XRC_DRAWABLE, DixWriteAccess)))
           return BadDrawable;