Skip to content

N
nx-libs
Commit 9501bce2 authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Ulrich Sibiller
Browse files
Options

integer overflow in XGetImage() [CVE-2013-1981 11/13]

Ensure that we don't underallocate when the server claims to have sent a very large reply. Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: 's avatarMatthieu Herrb <matthieu.herrb@laas.fr> Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 361d3677
Hide whitespace changes
Inline Side-by-side
Showing with 8 additions and 4 deletions
nx-X11/lib/X11/GetImage.c
View file @ 9501bce2
...@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group. ...@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
#include "Xlibint.h" #include "Xlibint.h"
#include <nx-X11/Xutil.h> /* for XDestroyImage */ #include <nx-X11/Xutil.h> /* for XDestroyImage */
#include "ImUtil.h" #include "ImUtil.h"
#include <limits.h>
#define ROUNDUP(nbytes, pad) (((((nbytes) - 1) + (pad)) / (pad)) * (pad)) #define ROUNDUP(nbytes, pad) (((((nbytes) - 1) + (pad)) / (pad)) * (pad))
...@@ -56,7 +57,7 @@ XImage *XGetImage ( ...@@ -56,7 +57,7 @@ XImage *XGetImage (
xGetImageReply rep; xGetImageReply rep;
register xGetImageReq *req; register xGetImageReq *req;
char *data; char *data;
long nbytes; unsigned long nbytes;
XImage *image; XImage *image;
LockDisplay(dpy); LockDisplay(dpy);
GetReq (GetImage, req); GetReq (GetImage, req);
...@@ -78,10 +79,13 @@ XImage *XGetImage ( ...@@ -78,10 +79,13 @@ XImage *XGetImage (
return (XImage *)NULL; return (XImage *)NULL;
} }
nbytes = (long)rep.length << 2; if (rep.length < (INT_MAX >> 2)) {
data = (char *) Xmalloc((unsigned) nbytes); nbytes = (unsigned long)rep.length << 2;
data = Xmalloc(nbytes);
} else
data = NULL;
if (! data) { if (! data) {
_XEatData(dpy, (unsigned long) nbytes); _XEatDataWords(dpy, rep.length);
UnlockDisplay(dpy); UnlockDisplay(dpy);
SyncHandle(); SyncHandle();
return (XImage *) NULL; return (XImage *) NULL;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment