frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

glx: Length checking for GLXRender requests (v2) [CVE-2014-8098 2/8] 

v2:
Remove can't-happen comparison for cmdlen < 0 (Michal Srb)

Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Michal Srb <msrb@suse.com>
Reviewed-by: Andy Ritger <aritger@nvidia.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
This commit is contained in:
Julien Cristau 2014-11-10 12:13:41 -05:00 committed by Alan Coopersmith
parent 2a5cbc17fc
commit be09e0c988
1 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
glx/glxcmds.c
View File

@ -2025,7 +2025,7 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
left = (req->length << 2) - sz_xGLXRenderReq; left = (req->length << 2) - sz_xGLXRenderReq;
while (left > 0) { while (left > 0) {
__GLXrenderSizeData entry; __GLXrenderSizeData entry;
int extra; int extra = 0;
__GLXdispatchRenderProcPtr proc; __GLXdispatchRenderProcPtr proc;
int err; int err;
@ -2044,6 +2044,9 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
cmdlen = hdr->length; cmdlen = hdr->length;
opcode = hdr->opcode; opcode = hdr->opcode;
if (left < cmdlen)
return BadLength;
/* /*
** Check for core opcodes and grab entry data. ** Check for core opcodes and grab entry data.
*/ */
@ -2057,6 +2060,10 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
return __glXError(GLXBadRenderRequest); return __glXError(GLXBadRenderRequest);
} }
if (cmdlen < entry.bytes) {
return BadLength;
}
if (entry.varsize) { if (entry.varsize) {
/* variable size command */ /* variable size command */
extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE, extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE,
@ -2064,17 +2071,9 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
if (extra < 0) { if (extra < 0) {
return BadLength; return BadLength;
} }
if (cmdlen != __GLX_PAD(entry.bytes + extra)) {
return BadLength;
} }
}
else { if (cmdlen != safe_pad(safe_add(entry.bytes, extra))) {
/* constant size command */
if (cmdlen != __GLX_PAD(entry.bytes)) {
return BadLength;
}
}
if (left < cmdlen) {
return BadLength; return BadLength;
} }