Skip to content

N
nx-libs
Commit ece51493 authored by Mike DePaulo's avatar Mike DePaulo Committed by Mike Gabriel
Browse files
Options

CVE-2014-0210: unvalidated length fields in fs_read_glyphs() from…

CVE-2014-0210: unvalidated length fields in fs_read_glyphs() from xorg/lib/libXfont commit 520683652564c2a4e42328ae23eef9bb63271565 fs_read_glyphs() parses a reply from the font server. The reply contains embedded length fields, none of which are validated. This can cause out of bound reads when looping over the glyph bitmaps in the reply.
parent d2b96c5d
Hide whitespace changes
Inline Side-by-side
Showing with 28 additions and 1 deletion
nx-X11/lib/font/fc/fserve.c
View file @ ece51493
...@@ -1916,6 +1916,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) ...@@ -1916,6 +1916,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
FontInfoPtr pfi = &pfont->info; FontInfoPtr pfi = &pfont->info;
fsQueryXBitmaps16Reply *rep; fsQueryXBitmaps16Reply *rep;
char *buf; char *buf;
long bufleft; /* length of reply left to use */
fsOffset32 *ppbits; fsOffset32 *ppbits;
fsOffset32 local_off; fsOffset32 local_off;
char *off_adr; char *off_adr;
...@@ -1947,9 +1948,33 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) ...@@ -1947,9 +1948,33 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
buf = (char *) rep; buf = (char *) rep;
buf += SIZEOF (fsQueryXBitmaps16Reply); buf += SIZEOF (fsQueryXBitmaps16Reply);
bufleft = rep->length << 2;
bufleft -= SIZEOF (fsQueryXBitmaps16Reply);
if ((bufleft / SIZEOF (fsOffset32)) < rep->num_chars)
{
#ifdef DEBUG
fprintf(stderr,
"fsQueryXBitmaps16: num_chars (%d) > bufleft (%ld) / %d\n",
rep->num_chars, bufleft, SIZEOF (fsOffset32));
#endif
err = AllocError;
goto bail;
}
ppbits = (fsOffset32 *) buf; ppbits = (fsOffset32 *) buf;
buf += SIZEOF (fsOffset32) * (rep->num_chars); buf += SIZEOF (fsOffset32) * (rep->num_chars);
bufleft -= SIZEOF (fsOffset32) * (rep->num_chars);
if (bufleft < rep->nbytes)
{
#ifdef DEBUG
fprintf(stderr,
"fsQueryXBitmaps16: nbytes (%d) > bufleft (%ld)\n",
rep->nbytes, bufleft);
#endif
err = AllocError;
goto bail;
}
pbitmaps = (pointer ) buf; pbitmaps = (pointer ) buf;
if (blockrec->type == FS_LOAD_GLYPHS) if (blockrec->type == FS_LOAD_GLYPHS)
...@@ -2007,7 +2032,9 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) ...@@ -2007,7 +2032,9 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
*/ */
if (NONZEROMETRICS(&fsdata->encoding[minchar].metrics)) if (NONZEROMETRICS(&fsdata->encoding[minchar].metrics))
{ {
if (local_off.length) if (local_off.length &&
(local_off.position < rep->nbytes) &&
(local_off.length <= (rep->nbytes - local_off.position)))
{ {
bits = allbits; bits = allbits;
allbits += local_off.length; allbits += local_off.length;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment