diff options
| author | Matthieu Herrb <matthieu.herrb@laas.fr> | 2008-06-08 11:13:47 -0600 |
|---|---|---|
| committer | Jeremy Huddleston <jeremyhu@freedesktop.org> | 2008-06-11 12:08:15 -0700 |
| commit | f912b5ccd3bfb8f0fc0d142feb88871858c07fb0 (patch) | |
| tree | 593e1cb80e85d12b7a57b1508499ff97bb2d7fd3 /mfb | |
| parent | 6d0a0a637f1863dfb6b300b1bb106415376b19e4 (diff) | |
CVE-2008-2360 - RENDER Extension heap buffer overflowserver-1.3-branch
An integer overflow may occur in the computation of the size of the
glyph to be allocated by the AllocateGlyph() function which will cause
less memory to be allocated than expected, leading to later heap
overflow.
On systems where the X SIGSEGV handler includes a stack trace, more
malloc()-type functions are called, which may lead to other
exploitable issues.
(cherry picked from commit b1a4a96885bf191d5f4afcfb2b41a88631b8412b)
Diffstat (limited to 'mfb')
0 files changed, 0 insertions, 0 deletions