From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Wed, 1 May 2013 17:59:31 -0700 Subject: [PATCH] integer overflow in read_packet() [CVE-2013-2064] Ensure that when calculating the size of the incoming response from the Xserver, we don't overflow the integer used in the calculations when we multiply the int32_t length by 4 and add it to the default response size. Signed-off-by: Alan Coopersmith --- src/xcb_in.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/xcb_in.c b/src/xcb_in.c index b810783..8a7af92 100644 --- a/src/xcb_in.c +++ b/src/xcb_in.c @@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete static int read_packet(xcb_connection_t *c) { xcb_generic_reply_t genrep; - int length = 32; - int eventlength = 0; /* length after first 32 bytes for GenericEvents */ + uint64_t length = 32; + uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */ + uint64_t bufsize; void *buf; pending_reply *pend = 0; struct event_list *event; @@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c) if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT) eventlength = genrep.length * 4; - buf = malloc(length + eventlength + - (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t))); + bufsize = length + eventlength + + (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)); + if (bufsize < INT32_MAX) + buf = malloc((size_t) bufsize); + else + buf = NULL; if(!buf) { _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT); -- 1.8.1.4