diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2013-05-28 15:52:32 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2013-06-27 05:37:18 +1000 |
| commit | 4c8e9bcab459ea5f870d3e56eff15f931807f9b7 (patch) | |
| tree | 8eca648742d6d46ad9e28967020fa04e29b37666 /src/XIPassiveGrab.c | |
| parent | 661c45ca17c434dbd342a46fd3fb813852ae0ca9 (diff) | |
Fix potential corruption in mask_len handling
First: check for allocation failure on the mask.
XI2 requires that the mask is zeroed, so we can't just Data() the mask
provided by the client (it will pad) - we need a tmp buffer. Make sure that
doesn't fail.
Second:
req->mask_len is a uint16_t, so check against malicious mask_lens that would
cause us to corrupt memory on copy, as the code always allocates
req->mask_len * 4, but copies mask->mask_len bytes.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'src/XIPassiveGrab.c')
| -rw-r--r-- | src/XIPassiveGrab.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/XIPassiveGrab.c b/src/XIPassiveGrab.c index 53b4084..4ed2f09 100644 --- a/src/XIPassiveGrab.c +++ b/src/XIPassiveGrab.c @@ -51,6 +51,14 @@ _XIPassiveGrabDevice(Display* dpy, int deviceid, int grabtype, int detail, if (_XiCheckExtInit(dpy, XInput_2_0, extinfo) == -1) return -1; + if (mask->mask_len > INT_MAX - 3 || + (mask->mask_len + 3)/4 >= 0xffff) + return -1; + + buff = calloc(4, (mask->mask_len + 3)/4); + if (!buff) + return -1; + GetReq(XIPassiveGrabDevice, req); req->reqType = extinfo->codes->major_opcode; req->ReqType = X_XIPassiveGrabDevice; @@ -68,7 +76,6 @@ _XIPassiveGrabDevice(Display* dpy, int deviceid, int grabtype, int detail, len = req->mask_len + num_modifiers; SetReqLen(req, len, len); - buff = calloc(4, req->mask_len); memcpy(buff, mask->mask, mask->mask_len); Data(dpy, buff, req->mask_len * 4); for (i = 0; i < num_modifiers; i++) |