summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthieu Herrb <matthieu@roadrock.(none)>2007-04-03 15:47:18 +0200
committerKeith Packard <keithp@neko.keithp.com>2007-04-05 23:32:56 -0700
commit44c4bd5df3aae191be9fc836be26f91497d02901 (patch)
tree43e142dc7b7a3aeb3e2728485e3e75f61a3569a2
parent44ea7a3e0d8fa636f4e5dd392caf618120d98413 (diff)
CVE-2007-1003: XC-MISC Extension ProcXCMiscGetXIDList() Memory Corruption
(cherry picked from commit 645d87cf8ef724d4591614f9994cdc4d7549a7a8)
-rw-r--r--Xext/xcmisc.c13
1 files changed, 11 insertions, 2 deletions
diff --git a/Xext/xcmisc.c b/Xext/xcmisc.c
index f26218e97..8c7a86e6a 100644
--- a/Xext/xcmisc.c
+++ b/Xext/xcmisc.c
@@ -42,6 +42,12 @@ from The Open Group.
#include <X11/extensions/xcmiscstr.h>
#include "modinit.h"
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
#if 0
static unsigned char XCMiscCode;
#endif
@@ -143,7 +149,10 @@ ProcXCMiscGetXIDList(client)
REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
- pids = (XID *)ALLOCATE_LOCAL(stuff->count * sizeof(XID));
+ if (stuff->count > UINT32_MAX / sizeof(XID))
+ return BadAlloc;
+
+ pids = (XID *)Xalloc(stuff->count * sizeof(XID));
if (!pids)
{
return BadAlloc;
@@ -164,7 +173,7 @@ ProcXCMiscGetXIDList(client)
client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
WriteSwappedDataToClient(client, count * sizeof(XID), pids);
}
- DEALLOCATE_LOCAL(pids);
+ Xfree(pids);
return(client->noClientException);
}