From 3c3a4b767b16174d3213055947ea7f4f88e10ec6 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Tue, 20 May 2025 15:18:19 +0200 Subject: [PATCH] randr: Check for overflow in RRChangeProviderProperty() A client might send a request causing an integer overflow when computing the total size to allocate in RRChangeProviderProperty(). To avoid the issue, check that total length in bytes won't exceed the maximum integer value. CVE-2025-49180 This issue was discovered by Nils Emmerich and reported by Julian Suleder via ERNW Vulnerability Disclosure. Signed-off-by: Olivier Fourdan Reviewed-by: Peter Hutterer Part-of: --- randr/rrproviderproperty.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c index 69f66ed27..0c3dcd1bc 100644 --- a/randr/rrproviderproperty.c +++ b/randr/rrproviderproperty.c @@ -182,7 +182,8 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type, if (mode == PropModeReplace || len > 0) { void *new_data = NULL, *old_data = NULL; - + if (total_len > MAXINT / size_in_bytes) + return BadValue; total_size = total_len * size_in_bytes; new_value.data = (void *) malloc(total_size); if (!new_value.data && total_size) {