Skip to content

N
nx-libs
Commit 7d18bbe9 authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Ulrich Sibiller
Browse files
Options

integer overflow in XGetMotionEvents() [CVE-2013-1981 4/13]

If the reported number of motion events is too large, the calculations to allocate memory for them may overflow, leaving us writing beyond the bounds of the allocation. v2: Ensure nEvents is set to 0 when returning NULL events pointer Reported-by: 's avatarIlja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 29779559
Show whitespace changes
Inline Side-by-side
Showing with 11 additions and 15 deletions
nx-X11/lib/X11/GetMoEv.c
View file @ 7d18bbe9
...@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group. ...@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
#include <config.h> #include <config.h>
#endif #endif
#include "Xlibint.h" #include "Xlibint.h"
#include <limits.h>
XTimeCoord *XGetMotionEvents( XTimeCoord *XGetMotionEvents(
register Display *dpy, register Display *dpy,
...@@ -39,7 +40,6 @@ XTimeCoord *XGetMotionEvents( ...@@ -39,7 +40,6 @@ XTimeCoord *XGetMotionEvents(
xGetMotionEventsReply rep; xGetMotionEventsReply rep;
register xGetMotionEventsReq *req; register xGetMotionEventsReq *req;
XTimeCoord *tc = NULL; XTimeCoord *tc = NULL;
long nbytes;
LockDisplay(dpy); LockDisplay(dpy);
GetReq(GetMotionEvents, req); GetReq(GetMotionEvents, req);
req->window = w; req->window = w;
...@@ -52,26 +52,22 @@ XTimeCoord *XGetMotionEvents( ...@@ -52,26 +52,22 @@ XTimeCoord *XGetMotionEvents(
return (NULL); return (NULL);
} }
if (rep.nEvents) { if (rep.nEvents && (rep.nEvents < (INT_MAX / sizeof(XTimeCoord))))
if (! (tc = (XTimeCoord *) tc = Xmalloc(rep.nEvents * sizeof(XTimeCoord));
Xmalloc( (unsigned) if (tc == NULL) {
(nbytes = (long) rep.nEvents * sizeof(XTimeCoord))))) { /* server returned either no events or a bad event count */
_XEatData (dpy, (unsigned long) nbytes); *nEvents = 0;
UnlockDisplay(dpy); _XEatDataWords (dpy, rep.length);
SyncHandle();
return (NULL);
} }
} else
*nEvents = rep.nEvents;
nbytes = SIZEOF (xTimecoord);
{ {
register XTimeCoord *tcptr; register XTimeCoord *tcptr;
register int i; unsigned int i;
xTimecoord xtc; xTimecoord xtc;
*nEvents = (int) rep.nEvents;
for (i = rep.nEvents, tcptr = tc; i > 0; i--, tcptr++) { for (i = rep.nEvents, tcptr = tc; i > 0; i--, tcptr++) {
_XRead (dpy, (char *) &xtc, nbytes); _XRead (dpy, (char *) &xtc, SIZEOF (xTimecoord));
tcptr->time = xtc.time; tcptr->time = xtc.time;
tcptr->x = cvtINT16toShort (xtc.x); tcptr->x = cvtINT16toShort (xtc.x);
tcptr->y = cvtINT16toShort (xtc.y); tcptr->y = cvtINT16toShort (xtc.y);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment