Skip to content

N
nx-libs
Commit cea44678 authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Mike Gabriel
Browse files
Options

randr: unvalidated lengths in RandR extension swapped procs [CVE-2014-8101]

v2: backport to nx-libs 3.6.x (Mike DePaulo) Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: 's avatarPeter Hutterer <peter.hutterer@who-t.net>
parent c12a473f
Hide whitespace changes
Inline Side-by-side
Showing with 3 additions and 0 deletions
nx-X11/programs/Xserver/randr/rrsdispatch.c
View file @ cea44678
......@@ -28,6 +28,7 @@ SProcRRQueryVersion (ClientPtr client)
register int n;
REQUEST(xRRQueryVersionReq);
REQUEST_SIZE_MATCH(xRRQueryVersionReq);
swaps(&stuff->length, n);
swapl(&stuff->majorVersion, n);
swapl(&stuff->minorVersion, n);
......@@ -40,6 +41,7 @@ SProcRRGetScreenInfo (ClientPtr client)
register int n;
REQUEST(xRRGetScreenInfoReq);
REQUEST_SIZE_MATCH(xRRGetScreenInfoReq);
swaps(&stuff->length, n);
swapl(&stuff->window, n);
return (*ProcRandrVector[stuff->randrReqType]) (client);
......@@ -75,6 +77,7 @@ SProcRRSelectInput (ClientPtr client)
register int n;
REQUEST(xRRSelectInputReq);
REQUEST_SIZE_MATCH(xRRSelectInputReq);
swaps(&stuff->length, n);
swapl(&stuff->window, n);
swaps(&stuff->enable, n);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment