From 68bf50ce4903ec93da59cea78e063ed7c3882d3e Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sat, 13 Apr 2013 20:49:43 -0700 Subject: integer overflow in uniDRIOpenConnection() in libchromeXvMC* [CVE-2013-1994 1/2] busIdStringLength is a CARD32 and needs to be bounds checked before adding one to it to come up with the total size to allocate, to avoid integer overflow leading to underallocation and writing data from the network past the end of the allocated buffer. Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith --- src/xvmc/xf86dri.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/xvmc/xf86dri.c b/src/xvmc/xf86dri.c index 1feb232..fba7583 100644 --- a/src/xvmc/xf86dri.c +++ b/src/xvmc/xf86dri.c @@ -42,6 +42,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. #include #include #include "xf86dristr.h" +#include static XExtensionInfo _xf86dri_info_data; static XExtensionInfo *xf86dri_info = &_xf86dri_info_data; @@ -203,7 +204,11 @@ uniDRIOpenConnection(dpy, screen, hSAREA, busIdString) } #endif if (rep.length) { - if (!(*busIdString = (char *)Xcalloc(rep.busIdStringLength + 1, 1))) { + if (rep.busIdStringLength < INT_MAX) + *busIdString = Xcalloc(rep.busIdStringLength + 1, 1); + else + *busIdString = NULL; + if (*busIdString == NULL) { _XEatData(dpy, ((rep.busIdStringLength + 3) & ~3)); UnlockDisplay(dpy); SyncHandle(); -- cgit v1.2.1