diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-13 10:24:08 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:54:16 -0700 |
| commit | c480fe3271873ec7471b0cbd680f4dac18ca8904 (patch) | |
| tree | 705d4675da377371a3663e9d8f8302f35d4485d8 /xfixes.pc.in | |
| parent | b031e3b60fa1af9e49449f23d4a84395868be3ab (diff) | |
integer overflow in XFixesGetCursorImage() [CVE-2013-1983]
If the reported cursor dimensions or name length are too large, the
calculations to allocate memory for them may overflow, leaving us
writing beyond the bounds of the allocation.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'xfixes.pc.in')
0 files changed, 0 insertions, 0 deletions