frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/dix
History
Alan Coopersmith 97015a07b9 dix: integer overflow in RegionSizeof() [CVE-2014-8092 3/4] 
RegionSizeof contains several integer overflows if a large length
value is passed in.  Once we fix it to return 0 on overflow, we
also have to fix the callers to handle this error condition

v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
 		2014-12-08 18:09:47 -08:00
..
.gitignore dix and os: gitignore dix.O and os.O 2011-09-23 17:14:47 -07:00
BuiltInAtoms R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
Makefile.am Allow DDX to provide a main() 2013-07-23 23:56:58 +01:00
Xserver-dtrace.h.in dix: add dtrace probes to input API 2012-03-22 11:33:42 +10:00
Xserver.d dix: add dtrace probes to input API 2012-03-22 11:33:42 +10:00
atom.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
buildatoms XFree86 4.3.0.1 2003-11-14 16:49:22 +00:00
colormap.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
cursor.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
devices.c fix an annotation mistake 2014-11-12 10:26:02 +10:00
dispatch.c dix: integer overflow in ProcPutImage() [CVE-2014-8092 1/4] 2014-12-08 18:09:46 -08:00
dispatch.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
dixfonts.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
dixutils.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
enterleave.c input: drop FP1616 macro 2012-11-19 12:12:23 +10:00
enterleave.h dix: Move DeviceFocusEvent from Xi into enterleave.c 2012-05-17 08:50:44 +10:00
eventconvert.c dix: send the current axis value in DeviceChangedEvents (#62321) 2013-05-07 09:40:42 +10:00
events.c dix: reference the cursor just once in InitializeSprite() 2014-06-04 21:32:14 -07:00
extension.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
ffs.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
gc.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
getevents.c dix: Untwist transformAbsolute logic, eliminate uninitialized value warnings 2014-10-28 20:56:37 -07:00
globals.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
glyphcurs.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
grabs.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
initatoms.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
inpututils.c dix: silence compiler warning 2014-11-12 10:25:00 +10:00
main.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
pixmap.c pixmap: fix reverse optimus support with multiple heads 2014-09-11 18:14:44 -07:00
privates.c Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
property.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
protocol.txt dix: Remove XpExtension leftovers from protocol.txt 2014-10-02 10:16:24 -07:00
ptrveloc.c dix: allow a ConstantDeceleration between 0 and 1 (#66134) 2013-07-17 14:27:26 +10:00
region.c dix: integer overflow in RegionSizeof() [CVE-2014-8092 3/4] 2014-12-08 18:09:47 -08:00
registry.c Build required portions of registry.c automatically [v2] 2014-09-18 15:29:29 -07:00
resource.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
selection.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
stubmain.c Allow DDX to provide a main() 2013-07-23 23:56:58 +01:00
swaprep.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
swapreq.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
tables.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
touch.c Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
window.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00