xkb: fix off-by-one in _XkbReadGetNamesReply and _XkbReadVirtualModMap

The size of the arrays is max_key_code + 1. This makes these functions consistent with the other checks added for CVE-2013-1997. Also check the XkbGetNames reply when names->keys was just allocated. Signed-off-by: Julien Cristau <jcristau@debian.org> Tested-by: Colin Walters <walters@verbum.org> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>

xkb: fix off-by-one in _XkbReadGetNamesReply and _XkbReadVirtualModMap
78ed2333 · Julien Cristau · Ulrich Sibiller · 082e8313 · 78ed2333 · 78ed2333
Commit 78ed2333 authored May 23, 2013 by Julien Cristau Committed by Ulrich Sibiller Oct 19, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

XKBGetMap.c nx-X11/lib/X11/XKBGetMap.c +1 -1

XKBNames.c nx-X11/lib/X11/XKBNames.c +1 -1

No files found.
--- a/nx-X11/lib/X11/XKBGetMap.c
+++ b/nx-X11/lib/X11/XKBGetMap.c
@@ -427,7 +427,7 @@ XkbServerMapPtr		srv;
    if ( rep->totalVModMapKeys>0 ) {
 	if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
-	     > xkb->max_key_code)
+	     > xkb->max_key_code + 1)
 	    return BadLength;
 	if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
 	    (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {

--- a/nx-X11/lib/X11/XKBNames.c
+++ b/nx-X11/lib/X11/XKBNames.c
@@ -180,7 +180,7 @@ _XkbReadGetNamesReply(	Display *		dpy,
 	    nKeys= xkb->max_key_code+1;
 	    names->keys= _XkbTypedCalloc(nKeys,XkbKeyNameRec);
 	}
-	else if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code)
+	if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code + 1)
 	    goto BAILOUT;
 	if (names->keys!=NULL) {
 	    if (!_XkbCopyFromReadBuffer(&buf,