summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichal Srb <msrb@suse.com>2017-07-28 16:27:10 +0200
committerJulien Cristau <jcristau@debian.org>2017-10-04 21:06:17 +0200
commitb95f25af141d33a65f6f821ea9c003f66a01e1f1 (patch)
tree9ce19efcdc87ee289facb4b6ac2a9dbebe94f7b1
parentdb465bae533f85e7f900deb96efecc831c9d550b (diff)
Xext/shm: Validate shmseg resource id (CVE-2017-13721)
Otherwise it can belong to a non-existing client and abort X server with FatalError "client not in use", or overwrite existing segment of another existing client. Signed-off-by: Julien Cristau <jcristau@debian.org>
-rw-r--r--Xext/shm.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/Xext/shm.c b/Xext/shm.c
index 91ea90b14..2f9a78808 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -1238,6 +1238,7 @@ ProcShmCreateSegment(ClientPtr client)
};
REQUEST_SIZE_MATCH(xShmCreateSegmentReq);
+ LEGAL_NEW_RESOURCE(stuff->shmseg, client);
if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) {
client->errorValue = stuff->readOnly;
return BadValue;