diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2014-01-26 19:28:05 -0800 |
|---|---|---|
| committer | Julien Cristau <jcristau@debian.org> | 2014-12-09 17:50:12 +0100 |
| commit | e3a1255a727518332c4a8d2af30c357aee0d50f0 (patch) | |
| tree | b65c2e3bed319850fd7516f8941e9c8b6964065d /dri3 | |
| parent | c092c31c83706cc449787d2378b7d4970e9eba8f (diff) | |
dri3: unvalidated lengths in DRI3 extension swapped procs [CVE-2014-8103 1/2]
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 0a6085aaf3581cca558d960ea176ddf3a41a2213)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Diffstat (limited to 'dri3')
| -rw-r--r-- | dri3/dri3_request.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/dri3/dri3_request.c b/dri3/dri3_request.c index fe45620c9..2d7558863 100644 --- a/dri3/dri3_request.c +++ b/dri3/dri3_request.c @@ -321,6 +321,7 @@ static int sproc_dri3_query_version(ClientPtr client) { REQUEST(xDRI3QueryVersionReq); + REQUEST_SIZE_MATCH(xDRI3QueryVersionReq); swaps(&stuff->length); swapl(&stuff->majorVersion); @@ -332,6 +333,7 @@ static int sproc_dri3_open(ClientPtr client) { REQUEST(xDRI3OpenReq); + REQUEST_SIZE_MATCH(xDRI3OpenReq); swaps(&stuff->length); swapl(&stuff->drawable); @@ -343,6 +345,7 @@ static int sproc_dri3_pixmap_from_buffer(ClientPtr client) { REQUEST(xDRI3PixmapFromBufferReq); + REQUEST_SIZE_MATCH(xDRI3PixmapFromBufferReq); swaps(&stuff->length); swapl(&stuff->pixmap); @@ -358,6 +361,7 @@ static int sproc_dri3_buffer_from_pixmap(ClientPtr client) { REQUEST(xDRI3BufferFromPixmapReq); + REQUEST_SIZE_MATCH(xDRI3BufferFromPixmapReq); swaps(&stuff->length); swapl(&stuff->pixmap); @@ -368,6 +372,7 @@ static int sproc_dri3_fence_from_fd(ClientPtr client) { REQUEST(xDRI3FenceFromFDReq); + REQUEST_SIZE_MATCH(xDRI3FenceFromFDReq); swaps(&stuff->length); swapl(&stuff->drawable); @@ -379,6 +384,7 @@ static int sproc_dri3_fd_from_fence(ClientPtr client) { REQUEST(xDRI3FDFromFenceReq); + REQUEST_SIZE_MATCH(xDRI3FDFromFenceReq); swaps(&stuff->length); swapl(&stuff->drawable); |