frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

glx: Request length checks for SetClientInfoARB [CVE-2014-8098 5/8] 

Reviewed-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Michal Srb <msrb@suse.com>
Reviewed-by: Andy Ritger <aritger@nvidia.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
This commit is contained in:
Adam Jackson 2014-11-10 12:13:45 -05:00 committed by Alan Coopersmith
parent c91e4abc3b
commit afe177020d
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
glx/clientinfo.c
View File

@ -33,18 +33,21 @@ static int
set_client_info(__GLXclientState * cl, xGLXSetClientInfoARBReq * req, set_client_info(__GLXclientState * cl, xGLXSetClientInfoARBReq * req,
unsigned bytes_per_version) unsigned bytes_per_version)
{ {
ClientPtr client = cl->client;
char *gl_extensions; char *gl_extensions;
char *glx_extensions; char *glx_extensions;
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
/* Verify that the size of the packet matches the size inferred from the /* Verify that the size of the packet matches the size inferred from the
* sizes specified for the various fields. * sizes specified for the various fields.
*/ */
const unsigned expected_size = sz_xGLXSetClientInfoARBReq int size = sz_xGLXSetClientInfoARBReq;
+ (req->numVersions * bytes_per_version) size = safe_add(size, safe_mul(req->numVersions, bytes_per_version));
+ __GLX_PAD(req->numGLExtensionBytes) size = safe_add(size, safe_pad(req->numGLExtensionBytes));
+ __GLX_PAD(req->numGLXExtensionBytes); size = safe_add(size, safe_pad(req->numGLXExtensionBytes));
if (req->length != (expected_size / 4)) if (size < 0 || req->length != (size / 4))
return BadLength; return BadLength;
/* Verify that the actual length of the GL extension string matches what's /* Verify that the actual length of the GL extension string matches what's
@ -80,8 +83,11 @@ __glXDisp_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
int int
__glXDispSwap_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc) __glXDispSwap_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
{ {
ClientPtr client = cl->client;
xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc; xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
req->length = bswap_16(req->length); req->length = bswap_16(req->length);
req->numVersions = bswap_32(req->numVersions); req->numVersions = bswap_32(req->numVersions);
req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes); req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
@ -99,8 +105,11 @@ __glXDisp_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
int int
__glXDispSwap_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc) __glXDispSwap_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
{ {
ClientPtr client = cl->client;
xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc; xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
req->length = bswap_16(req->length); req->length = bswap_16(req->length);
req->numVersions = bswap_32(req->numVersions); req->numVersions = bswap_32(req->numVersions);
req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes); req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);