From 3ec2db9eeb9ba8fb561802b0c4b8bf79e321b7a2 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Fri, 12 Apr 2013 23:36:13 -0700 Subject: integer overflow in XResQueryClients() [CVE-2013-1988 1/2] The CARD32 rep.num_clients needs to be bounds checked before multiplying by sizeof(XResClient) to avoid integer overflow leading to underallocation and writing data from the network past the end of the allocated buffer. Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith --- src/XRes.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/XRes.c b/src/XRes.c index ae86206..5117321 100644 --- a/src/XRes.c +++ b/src/XRes.c @@ -129,7 +129,12 @@ Status XResQueryClients ( } if(rep.num_clients) { - if((clnts = Xmalloc(sizeof(XResClient) * rep.num_clients))) { + if (rep.num_clients < (INT_MAX / sizeof(XResClient))) + clnts = Xmalloc(sizeof(XResClient) * rep.num_clients); + else + clnts = NULL; + + if (clnts != NULL) { xXResClient scratch; int i; -- cgit v1.2.3