diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2014-04-25 23:02:42 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2014-05-12 23:31:56 -0700 |
| commit | c578408c1fd4db09e4e3173f8a9e65c81cc187c1 (patch) | |
| tree | 1a999d99d2dc8ec3fc7dc415fec19848b98327a2 | |
| parent | 491291cabf78efdeec8f18b09e14726a9030cc8f (diff) | |
CVE-2014-0211: integer overflow in fs_read_extent_info()
fs_read_extent_info() parses a reply from the font server.
The reply contains a 32bit number of elements field which is used
to calculate a buffer length. There is an integer overflow in this
calculation which can lead to memory corruption.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
| -rw-r--r-- | src/fc/fserve.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/src/fc/fserve.c b/src/fc/fserve.c index ec5336e..96abd0e 100644 --- a/src/fc/fserve.c +++ b/src/fc/fserve.c @@ -70,6 +70,7 @@ in this Software without prior written authorization from The Open Group. #include "fservestr.h" #include <X11/fonts/fontutil.h> #include <errno.h> +#include <limits.h> #include <time.h> #define Time_t time_t @@ -1050,7 +1051,16 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) numInfos *= 2; haveInk = TRUE; } - ci = pCI = malloc(sizeof(CharInfoRec) * numInfos); + if (numInfos >= (INT_MAX / sizeof(CharInfoRec))) { +#ifdef DEBUG + fprintf(stderr, + "fsQueryXExtents16: numInfos (%d) >= %ld\n", + numInfos, (INT_MAX / sizeof(CharInfoRec))); +#endif + pCI = NULL; + } + else + pCI = malloc(sizeof(CharInfoRec) * numInfos); if (!pCI) { |