frederik
/
libxcb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

integer overflow in read_packet() [CVE-2013-2064] 

Ensure that when calculating the size of the incoming response from the
Xserver, we don't overflow the integer used in the calculations when we
multiply the int32_t length by 4 and add it to the default response size.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 1b33867fa9)
This commit is contained in:
Alan Coopersmith 2013-05-01 17:59:31 -07:00
parent 6b6044cb8a
commit 75680fde0d
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/xcb_in.c
View File

@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
static int read_packet(xcb_connection_t *c)
{
xcb_generic_reply_t genrep;
int length = 32;
int eventlength = 0; /* length after first 32 bytes for GenericEvents */
uint64_t length = 32;
uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
uint64_t bufsize;
void *buf;
pending_reply *pend = 0;
struct event_list *event;
@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
eventlength = genrep.length * 4;
buf = malloc(length + eventlength +
(genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
bufsize = length + eventlength +
(genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
if (bufsize < INT32_MAX)
buf = malloc((size_t) bufsize);
else
buf = NULL;
if(!buf)
{
_xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);