mirror of
https://git.freebsd.org/ports.git
synced 2025-07-15 16:29:15 -04:00
05d144d761
Bump all the slaves due to not being sure where the shared code is used. MFH: 2017Q4 Security: 7274e0cc-575f-41bc-8619-14a41b3c2ad0
41 lines
1.4 KiB
Text
41 lines
1.4 KiB
Text
From cc41e5b581d287c56f8d7113a97a4882dcfdd696 Mon Sep 17 00:00:00 2001
|
|
From: Nathan Kidd <nkidd@opentext.com>
|
|
Date: Fri, 9 Jan 2015 10:09:14 -0500
|
|
Subject: dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo
|
|
(CVE-2017-12177)
|
|
|
|
v2: Protect against integer overflow (Alan Coopersmith)
|
|
|
|
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
|
|
Reviewed-by: Julien Cristau <jcristau@debian.org>
|
|
Signed-off-by: Nathan Kidd <nkidd@opentext.com>
|
|
Signed-off-by: Julien Cristau <jcristau@debian.org>
|
|
(cherry picked from commit 4ca68b878e851e2136c234f40a25008297d8d831)
|
|
|
|
diff --git a/dbe/dbe.c b/dbe/dbe.c
|
|
index 23f7e16..f31766f 100644
|
|
--- dbe/dbe.c
|
|
+++ dbe/dbe.c
|
|
@@ -574,6 +574,9 @@ ProcDbeGetVisualInfo(ClientPtr client)
|
|
XdbeScreenVisualInfo *pScrVisInfo;
|
|
|
|
REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
|
|
+ if (stuff->n > UINT32_MAX / sizeof(CARD32))
|
|
+ return BadLength;
|
|
+ REQUEST_FIXED_SIZE(xDbeGetVisualInfoReq, stuff->n * sizeof(CARD32));
|
|
|
|
if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
|
|
return BadAlloc;
|
|
@@ -924,7 +927,7 @@ SProcDbeSwapBuffers(ClientPtr client)
|
|
|
|
swapl(&stuff->n);
|
|
if (stuff->n > UINT32_MAX / sizeof(DbeSwapInfoRec))
|
|
- return BadAlloc;
|
|
+ return BadLength;
|
|
REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, stuff->n * sizeof(xDbeSwapInfo));
|
|
|
|
if (stuff->n != 0) {
|
|
--
|
|
cgit v0.10.2
|
|
|