|
 |
0fd959 |
From 4c8973a3f7632b82367c439b30c2b9444112c2ac Mon Sep 17 00:00:00 2001
|
|
|
0fd959 |
From: Adam Jackson <ajax@redhat.com>
|
|
|
0fd959 |
Date: Mon, 10 Nov 2014 12:13:45 -0500
|
|
|
0fd959 |
Subject: [PATCH 28/33] glx: Request length checks for SetClientInfoARB
|
|
|
0fd959 |
[CVE-2014-8098 5/8]
|
|
|
0fd959 |
|
|
|
0fd959 |
Reviewed-by: Keith Packard <keithp@keithp.com>
|
|
|
0fd959 |
Reviewed-by: Julien Cristau <jcristau@debian.org>
|
|
|
0fd959 |
Reviewed-by: Michal Srb <msrb@suse.com>
|
|
|
0fd959 |
Reviewed-by: Andy Ritger <aritger@nvidia.com>
|
|
|
0fd959 |
Signed-off-by: Adam Jackson <ajax@redhat.com>
|
|
|
0fd959 |
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
0fd959 |
Signed-off-by: Fedora X Ninjas <x@fedoraproject.org>
|
|
|
0fd959 |
---
|
|
|
0fd959 |
glx/clientinfo.c | 19 ++++++++++++++-----
|
|
|
0fd959 |
1 file changed, 14 insertions(+), 5 deletions(-)
|
|
|
0fd959 |
|
|
|
0fd959 |
diff --git a/glx/clientinfo.c b/glx/clientinfo.c
|
|
|
0fd959 |
index 4aaa4c9..c5fef30 100644
|
|
|
0fd959 |
--- a/glx/clientinfo.c
|
|
|
0fd959 |
+++ b/glx/clientinfo.c
|
|
|
0fd959 |
@@ -33,18 +33,21 @@ static int
|
|
|
0fd959 |
set_client_info(__GLXclientState * cl, xGLXSetClientInfoARBReq * req,
|
|
|
0fd959 |
unsigned bytes_per_version)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
+ ClientPtr client = cl->client;
|
|
|
0fd959 |
char *gl_extensions;
|
|
|
0fd959 |
char *glx_extensions;
|
|
|
0fd959 |
|
|
|
0fd959 |
+ REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
|
|
|
0fd959 |
+
|
|
|
0fd959 |
/* Verify that the size of the packet matches the size inferred from the
|
|
|
0fd959 |
* sizes specified for the various fields.
|
|
|
0fd959 |
*/
|
|
|
0fd959 |
- const unsigned expected_size = sz_xGLXSetClientInfoARBReq
|
|
|
0fd959 |
- + (req->numVersions * bytes_per_version)
|
|
|
0fd959 |
- + __GLX_PAD(req->numGLExtensionBytes)
|
|
|
0fd959 |
- + __GLX_PAD(req->numGLXExtensionBytes);
|
|
|
0fd959 |
+ int size = sz_xGLXSetClientInfoARBReq;
|
|
|
0fd959 |
+ size = safe_add(size, safe_mul(req->numVersions, bytes_per_version));
|
|
|
0fd959 |
+ size = safe_add(size, safe_pad(req->numGLExtensionBytes));
|
|
|
0fd959 |
+ size = safe_add(size, safe_pad(req->numGLXExtensionBytes));
|
|
|
0fd959 |
|
|
|
0fd959 |
- if (req->length != (expected_size / 4))
|
|
|
0fd959 |
+ if (size < 0 || req->length != (size / 4))
|
|
|
0fd959 |
return BadLength;
|
|
|
0fd959 |
|
|
|
0fd959 |
/* Verify that the actual length of the GL extension string matches what's
|
|
|
0fd959 |
@@ -80,8 +83,11 @@ __glXDisp_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
|
|
|
0fd959 |
int
|
|
|
0fd959 |
__glXDispSwap_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
+ ClientPtr client = cl->client;
|
|
|
0fd959 |
xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
|
|
|
0fd959 |
|
|
|
0fd959 |
+ REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
|
|
|
0fd959 |
+
|
|
|
0fd959 |
req->length = bswap_16(req->length);
|
|
|
0fd959 |
req->numVersions = bswap_32(req->numVersions);
|
|
|
0fd959 |
req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
|
|
|
0fd959 |
@@ -99,8 +105,11 @@ __glXDisp_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
|
|
|
0fd959 |
int
|
|
|
0fd959 |
__glXDispSwap_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
|
|
|
0fd959 |
{
|
|
|
0fd959 |
+ ClientPtr client = cl->client;
|
|
|
0fd959 |
xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
|
|
|
0fd959 |
|
|
|
0fd959 |
+ REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
|
|
|
0fd959 |
+
|
|
|
0fd959 |
req->length = bswap_16(req->length);
|
|
|
0fd959 |
req->numVersions = bswap_32(req->numVersions);
|
|
|
0fd959 |
req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
|
|
|
0fd959 |
--
|
|
|
0fd959 |
1.9.3
|
|
|
0fd959 |
|