From 5fbd8c45b46ab93522e417240aa770466c30b735 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sun, 14 Apr 2013 09:45:26 -0700 Subject: [PATCH] Xdmx: integer overflow in GetGLXFBConfigs() numFBConfigs & numAttribs are CARD32s and need to be bounds checked before multiplying by structure sizes to come up with the total size to allocate, to avoid integer overflow leading to underallocation and writing data from the network past the end of the allocated buffer. Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith --- hw/dmx/dmx_glxvisuals.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/hw/dmx/dmx_glxvisuals.c b/hw/dmx/dmx_glxvisuals.c index 027557add..56bd67b6e 100644 --- a/hw/dmx/dmx_glxvisuals.c +++ b/hw/dmx/dmx_glxvisuals.c @@ -279,7 +279,10 @@ GetGLXFBConfigs(Display * dpy, int glxMajorOpcode, int *nconfigs) return NULL; } - attrs = (INT32 *) Xmalloc(2 * numAttribs * __GLX_SIZE_CARD32); + if (numAttribs < (INT_MAX / (2 * __GLX_SIZE_CARD32))) + attrs = Xmalloc(2 * numAttribs * __GLX_SIZE_CARD32); + else + attrs = NULL; if (!attrs) { UnlockDisplay(dpy); SyncHandle(); @@ -287,15 +290,16 @@ GetGLXFBConfigs(Display * dpy, int glxMajorOpcode, int *nconfigs) } /* Allocate memory for our config structure */ - config = (__GLXFBConfig *) - Xmalloc(numFBConfigs * sizeof(__GLXFBConfig)); + if (numFBConfigs < (INT_MAX / sizeof(__GLXFBConfig))) + config = Xcalloc(numFBConfigs, sizeof(__GLXFBConfig)); + else + config = NULL; if (!config) { free(attrs); UnlockDisplay(dpy); SyncHandle(); return NULL; } - memset(config, 0, numFBConfigs * sizeof(__GLXFBConfig)); fbconfigs = config; /* Convert attribute list into our format */