• Alan Coopersmith's avatar
    Xi: unvalidated lengths in Xinput extension [CVE-2014-8095] · fde1375e
    Alan Coopersmith authored
    Multiple functions in the Xinput extension handling of requests from
    clients failed to check that the length of the request sent by the
    client was large enough to perform all the required operations and
    thus could read or write to memory outside the bounds of the request
    buffer.
    
    This commit includes the creation of a new REQUEST_AT_LEAST_EXTRA_SIZE
    macro in include/dix.h for the common case of needing to ensure a
    request is large enough to include both the request itself and a
    minimum amount of extra data following the request header.
    
    v2: backport to nx-libs 3.6.x (Mike DePaulo)
    Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: 's avatarPeter Hutterer <peter.hutterer@who-t.net>
    
    Conflicts:
    	Xi/chgdctl.c
    	Xi/chgfctl.c
    	Xi/xiallowev.c
    	Xi/xichangecursor.c
    	Xi/xichangehierarchy.c
    	Xi/xigetclientpointer.c
    	Xi/xigrabdev.c
    	Xi/xipassivegrab.c
    	Xi/xiproperty.c
    	Xi/xiquerydevice.c
    	Xi/xiquerypointer.c
    	Xi/xiselectev.c
    	Xi/xisetclientpointer.c
    	Xi/xisetdevfocus.c
    	Xi/xiwarppointer.c
    
    [RHEL5: Xi/xi* files are XI2 ]
    fde1375e
Name
Last commit
Last update
bin Loading commit data...
debian Loading commit data...
doc/nx-X11_vs_XOrg69_patches Loading commit data...
etc Loading commit data...
nx-X11 Loading commit data...
nxcomp Loading commit data...
nxcompext Loading commit data...
nxcompshad Loading commit data...
nxproxy Loading commit data...
COPYING Loading commit data...
ChangeLog Loading commit data...
Makefile Loading commit data...
README.NX-development Loading commit data...
README.keystrokes Loading commit data...
VERSION Loading commit data...
VERSION.x2goagent Loading commit data...
nx-libs.spec Loading commit data...
replace.sh Loading commit data...