frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

glx: Top-level length checking for swapped VendorPrivate requests [CVE-2014-8098 4/8] 

Reviewed-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Michal Srb <msrb@suse.com>
Reviewed-by: Andy Ritger <aritger@nvidia.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
This commit is contained in:
Adam Jackson 2014-11-10 12:13:44 -05:00 committed by Alan Coopersmith
parent a33a939e6a
commit c91e4abc3b
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
glx/glxcmdsswap.c
View File

@ -958,11 +958,13 @@ __glXDispSwap_RenderLarge(__GLXclientState * cl, GLbyte * pc)
int int
__glXDispSwap_VendorPrivate(__GLXclientState * cl, GLbyte * pc) __glXDispSwap_VendorPrivate(__GLXclientState * cl, GLbyte * pc)
{ {
ClientPtr client = cl->client;
xGLXVendorPrivateReq *req; xGLXVendorPrivateReq *req;
GLint vendorcode; GLint vendorcode;
__GLXdispatchVendorPrivProcPtr proc; __GLXdispatchVendorPrivProcPtr proc;
__GLX_DECLARE_SWAP_VARIABLES; __GLX_DECLARE_SWAP_VARIABLES;
REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateReq);
req = (xGLXVendorPrivateReq *) pc; req = (xGLXVendorPrivateReq *) pc;
__GLX_SWAP_SHORT(&req->length); __GLX_SWAP_SHORT(&req->length);
@ -985,11 +987,13 @@ __glXDispSwap_VendorPrivate(__GLXclientState * cl, GLbyte * pc)
int int
__glXDispSwap_VendorPrivateWithReply(__GLXclientState * cl, GLbyte * pc) __glXDispSwap_VendorPrivateWithReply(__GLXclientState * cl, GLbyte * pc)
{ {
ClientPtr client = cl->client;
xGLXVendorPrivateWithReplyReq *req; xGLXVendorPrivateWithReplyReq *req;
GLint vendorcode; GLint vendorcode;
__GLXdispatchVendorPrivProcPtr proc; __GLXdispatchVendorPrivProcPtr proc;
__GLX_DECLARE_SWAP_VARIABLES; __GLX_DECLARE_SWAP_VARIABLES;
REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateWithReplyReq);
req = (xGLXVendorPrivateWithReplyReq *) pc; req = (xGLXVendorPrivateWithReplyReq *) pc;
__GLX_SWAP_SHORT(&req->length); __GLX_SWAP_SHORT(&req->length);