|
 |
271698 |
From 5d201df72f3d4f4cb8b8f75f980169b03507da38 Mon Sep 17 00:00:00 2001
|
|
|
271698 |
From: Tobias Stoeckmann <tobias@stoeckmann.org>
|
|
|
271698 |
Date: Tue, 28 Nov 2017 21:38:07 +0100
|
|
|
271698 |
Subject: [PATCH] cursor: Fix heap overflows when parsing malicious files.
|
|
|
271698 |
|
|
|
271698 |
It is possible to trigger heap overflows due to an integer overflow
|
|
|
271698 |
while parsing images.
|
|
|
271698 |
|
|
|
271698 |
The integer overflow occurs because the chosen limit 0x10000 for
|
|
|
271698 |
dimensions is too large for 32 bit systems, because each pixel takes
|
|
|
271698 |
4 bytes. Properly chosen values allow an overflow which in turn will
|
|
|
271698 |
lead to less allocated memory than needed for subsequent reads.
|
|
|
271698 |
|
|
|
271698 |
See also: https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8
|
|
|
271698 |
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=103961
|
|
|
271698 |
|
|
|
271698 |
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
|
|
|
271698 |
[Pekka: add link to the corresponding libXcursor commit]
|
|
|
271698 |
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
|
|
|
271698 |
---
|
|
|
271698 |
cursor/xcursor.c | 8 +++++++-
|
|
|
271698 |
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
271698 |
|
|
|
271698 |
diff --git a/cursor/xcursor.c b/cursor/xcursor.c
|
|
|
271698 |
index ca41c4a..689c702 100644
|
|
|
271698 |
--- a/cursor/xcursor.c
|
|
|
271698 |
+++ b/cursor/xcursor.c
|
|
|
271698 |
@@ -202,6 +202,11 @@ XcursorImageCreate (int width, int height)
|
|
|
271698 |
{
|
|
|
271698 |
XcursorImage *image;
|
|
|
271698 |
|
|
|
271698 |
+ if (width < 0 || height < 0)
|
|
|
271698 |
+ return NULL;
|
|
|
271698 |
+ if (width > XCURSOR_IMAGE_MAX_SIZE || height > XCURSOR_IMAGE_MAX_SIZE)
|
|
|
271698 |
+ return NULL;
|
|
|
271698 |
+
|
|
|
271698 |
image = malloc (sizeof (XcursorImage) +
|
|
|
271698 |
width * height * sizeof (XcursorPixel));
|
|
|
271698 |
if (!image)
|
|
|
271698 |
@@ -482,7 +487,8 @@ _XcursorReadImage (XcursorFile *file,
|
|
|
271698 |
if (!_XcursorReadUInt (file, &head.delay))
|
|
|
271698 |
return NULL;
|
|
|
271698 |
/* sanity check data */
|
|
|
271698 |
- if (head.width >= 0x10000 || head.height > 0x10000)
|
|
|
271698 |
+ if (head.width > XCURSOR_IMAGE_MAX_SIZE ||
|
|
|
271698 |
+ head.height > XCURSOR_IMAGE_MAX_SIZE)
|
|
|
271698 |
return NULL;
|
|
|
271698 |
if (head.width == 0 || head.height == 0)
|
|
|
271698 |
return NULL;
|
|
|
271698 |
--
|
|
|
271698 |
2.14.3
|
|
|
271698 |
|