diff options
author | Matthieu Herrb <matthieu@blues.laas.fr> | 2007-01-09 14:13:40 +0100 |
---|---|---|
committer | Matthieu Herrb <matthieu@blues.laas.fr> | 2007-01-09 14:13:40 +0100 |
commit | 24e1ad483155601d5a60e2a3aa6125afd59bbd43 (patch) | |
tree | 0082ce949c82c39a8ff4bdce391e500a7280b54c /dbe | |
parent | fe37d26f30c7a5513c2b41822a4b5d787ace9ecb (diff) |
Multiple integer overflows in dbe and render extensions
CVE IDs: CVE-2006-6101 CVE-2006-6102 CVE-2006-6103
Diffstat (limited to 'dbe')
-rw-r--r-- | dbe/dbe.c | 34 |
1 files changed, 22 insertions, 12 deletions
@@ -39,6 +39,11 @@ #endif #include <string.h> +#if HAVE_STDINT_H +#include <stdint.h> +#elif !defined(UINT32_MAX) +#define UINT32_MAX 0xffffffffU +#endif #include <X11/X.h> #include <X11/Xproto.h> @@ -713,11 +718,14 @@ ProcDbeSwapBuffers(ClientPtr client) return(Success); } + if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec)) + return BadAlloc; + /* Get to the swap info appended to the end of the request. */ dbeSwapInfo = (xDbeSwapInfo *)&stuff[1]; /* Allocate array to record swap information. */ - swapInfo = (DbeSwapInfoPtr)ALLOCATE_LOCAL(nStuff * sizeof(DbeSwapInfoRec)); + swapInfo = (DbeSwapInfoPtr)Xalloc(nStuff * sizeof(DbeSwapInfoRec)); if (swapInfo == NULL) { return(BadAlloc); @@ -732,14 +740,14 @@ ProcDbeSwapBuffers(ClientPtr client) if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client, SecurityWriteAccess))) { - DEALLOCATE_LOCAL(swapInfo); + Xfree(swapInfo); return(BadWindow); } /* Each window must be double-buffered - BadMatch. */ if (DBE_WINDOW_PRIV(pWin) == NULL) { - DEALLOCATE_LOCAL(swapInfo); + Xfree(swapInfo); return(BadMatch); } @@ -748,7 +756,7 @@ ProcDbeSwapBuffers(ClientPtr client) { if (dbeSwapInfo[i].window == dbeSwapInfo[j].window) { - DEALLOCATE_LOCAL(swapInfo); + Xfree(swapInfo); return(BadMatch); } } @@ -759,7 +767,7 @@ ProcDbeSwapBuffers(ClientPtr client) (dbeSwapInfo[i].swapAction != XdbeUntouched ) && (dbeSwapInfo[i].swapAction != XdbeCopied )) { - DEALLOCATE_LOCAL(swapInfo); + Xfree(swapInfo); return(BadValue); } @@ -789,12 +797,12 @@ ProcDbeSwapBuffers(ClientPtr client) error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo); if (error != Success) { - DEALLOCATE_LOCAL(swapInfo); + Xfree(swapInfo); return(error); } } - DEALLOCATE_LOCAL(swapInfo); + Xfree(swapInfo); return(Success); } /* ProcDbeSwapBuffers() */ @@ -876,10 +884,12 @@ ProcDbeGetVisualInfo(ClientPtr client) REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq); + if (stuff->n > UINT32_MAX / sizeof(DrawablePtr)) + return BadAlloc; /* Make sure any specified drawables are valid. */ if (stuff->n != 0) { - if (!(pDrawables = (DrawablePtr *)ALLOCATE_LOCAL(stuff->n * + if (!(pDrawables = (DrawablePtr *)Xalloc(stuff->n * sizeof(DrawablePtr)))) { return(BadAlloc); @@ -892,7 +902,7 @@ ProcDbeGetVisualInfo(ClientPtr client) if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable( drawables[i], client, SecurityReadAccess))) { - DEALLOCATE_LOCAL(pDrawables); + Xfree(pDrawables); return(BadDrawable); } } @@ -904,7 +914,7 @@ ProcDbeGetVisualInfo(ClientPtr client) { if (pDrawables) { - DEALLOCATE_LOCAL(pDrawables); + Xfree(pDrawables); } return(BadAlloc); @@ -931,7 +941,7 @@ ProcDbeGetVisualInfo(ClientPtr client) /* Free pDrawables if we needed to allocate it above. */ if (pDrawables) { - DEALLOCATE_LOCAL(pDrawables); + Xfree(pDrawables); } return(BadAlloc); @@ -1012,7 +1022,7 @@ ProcDbeGetVisualInfo(ClientPtr client) if (pDrawables) { - DEALLOCATE_LOCAL(pDrawables); + Xfree(pDrawables); } return(client->noClientException); |