diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-03-02 11:01:04 -0800 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-09 18:59:52 -0700 |
| commit | 2df882eeb3a70256170127a746a9ba26376599a1 (patch) | |
| tree | 252ef1f61f1f47afd89f2ecccfddf2a8abd60461 | |
| parent | 4d7c422a37eb9617fb22f8e37527c2b34b105665 (diff) | |
unvalidated index in _XkbReadVirtualModMap() [CVE-2013-1997 10/15]
If the X server returns modifier map indexes outside the range of the number
of keys it told us to allocate, out of bounds memory writes could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
| -rw-r--r-- | src/xkb/XKBGetMap.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c index ea77f2a3..5551298c 100644 --- a/src/xkb/XKBGetMap.c +++ b/src/xkb/XKBGetMap.c @@ -425,6 +425,9 @@ xkbVModMapWireDesc * wire; XkbServerMapPtr srv; if ( rep->totalVModMapKeys>0 ) { + if (((int) rep->firstVModMapKey + rep->nVModMapKeys) + > xkb->max_key_code) + return BadLength; if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&& (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) { return BadAlloc; |