|
 |
0fd959 |
From f8d54fefd98dd2ffd8d5680a6b7b5276b683e3e0 Mon Sep 17 00:00:00 2001
|
|
|
0fd959 |
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
0fd959 |
Date: Sun, 26 Jan 2014 19:28:05 -0800
|
|
|
0fd959 |
Subject: [PATCH 11/33] dri3: unvalidated lengths in DRI3 extension swapped
|
|
|
0fd959 |
procs [CVE-2014-8103 1/2]
|
|
|
0fd959 |
|
|
|
0fd959 |
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
0fd959 |
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
|
0fd959 |
Signed-off-by: Fedora X Ninjas <x@fedoraproject.org>
|
|
|
0fd959 |
---
|
|
|
0fd959 |
dri3/dri3_request.c | 6 ++++++
|
|
|
0fd959 |
1 file changed, 6 insertions(+)
|
|
|
0fd959 |
|
|
|
0fd959 |
diff --git a/dri3/dri3_request.c b/dri3/dri3_request.c
|
|
|
0fd959 |
index 4e1408f..2d05066 100644
|
|
|
0fd959 |
--- a/dri3/dri3_request.c
|
|
|
0fd959 |
+++ b/dri3/dri3_request.c
|
|
|
0fd959 |
@@ -311,6 +311,7 @@ static int
|
|
|
0fd959 |
sproc_dri3_query_version(ClientPtr client)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
REQUEST(xDRI3QueryVersionReq);
|
|
|
0fd959 |
+ REQUEST_SIZE_MATCH(xDRI3QueryVersionReq);
|
|
|
0fd959 |
|
|
|
0fd959 |
swaps(&stuff->length);
|
|
|
0fd959 |
swapl(&stuff->majorVersion);
|
|
|
0fd959 |
@@ -322,6 +323,7 @@ static int
|
|
|
0fd959 |
sproc_dri3_open(ClientPtr client)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
REQUEST(xDRI3OpenReq);
|
|
|
0fd959 |
+ REQUEST_SIZE_MATCH(xDRI3OpenReq);
|
|
|
0fd959 |
|
|
|
0fd959 |
swaps(&stuff->length);
|
|
|
0fd959 |
swapl(&stuff->drawable);
|
|
|
0fd959 |
@@ -333,6 +335,7 @@ static int
|
|
|
0fd959 |
sproc_dri3_pixmap_from_buffer(ClientPtr client)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
REQUEST(xDRI3PixmapFromBufferReq);
|
|
|
0fd959 |
+ REQUEST_SIZE_MATCH(xDRI3PixmapFromBufferReq);
|
|
|
0fd959 |
|
|
|
0fd959 |
swaps(&stuff->length);
|
|
|
0fd959 |
swapl(&stuff->pixmap);
|
|
|
0fd959 |
@@ -348,6 +351,7 @@ static int
|
|
|
0fd959 |
sproc_dri3_buffer_from_pixmap(ClientPtr client)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
REQUEST(xDRI3BufferFromPixmapReq);
|
|
|
0fd959 |
+ REQUEST_SIZE_MATCH(xDRI3BufferFromPixmapReq);
|
|
|
0fd959 |
|
|
|
0fd959 |
swaps(&stuff->length);
|
|
|
0fd959 |
swapl(&stuff->pixmap);
|
|
|
0fd959 |
@@ -358,6 +362,7 @@ static int
|
|
|
0fd959 |
sproc_dri3_fence_from_fd(ClientPtr client)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
REQUEST(xDRI3FenceFromFDReq);
|
|
|
0fd959 |
+ REQUEST_SIZE_MATCH(xDRI3FenceFromFDReq);
|
|
|
0fd959 |
|
|
|
0fd959 |
swaps(&stuff->length);
|
|
|
0fd959 |
swapl(&stuff->drawable);
|
|
|
0fd959 |
@@ -369,6 +374,7 @@ static int
|
|
|
0fd959 |
sproc_dri3_fd_from_fence(ClientPtr client)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
REQUEST(xDRI3FDFromFenceReq);
|
|
|
0fd959 |
+ REQUEST_SIZE_MATCH(xDRI3FDFromFenceReq);
|
|
|
0fd959 |
|
|
|
0fd959 |
swaps(&stuff->length);
|
|
|
0fd959 |
swapl(&stuff->drawable);
|
|
|
0fd959 |
--
|
|
|
0fd959 |
1.9.3
|
|
|
0fd959 |
|