summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorTobias Stoeckmann <tobias@stoeckmann.org>2016-09-25 21:43:09 +0200
committerMatthieu Herrb <matthieu@herrb.eu>2016-09-25 22:15:13 +0200
commit9362c7ddd1af3b168953d0737877bc52d79c94f4 (patch)
tree161248ef97b1095a96bb5e701b69f928a20d3bcc /src
parent8fad00b0b647ee662ce4737ca15be033b7a21714 (diff)
Validate lengths while parsing server data.
Individual lengths inside received server data can overflow the previously reserved memory. It is therefore important to validate every single length field to not overflow the previously agreed sum of all invidual length fields. v2: consume remaining bytes in the reply buffer on error. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> Reviewed-by: Matthieu Herrb@laas.fr
Diffstat (limited to 'src')
-rw-r--r--src/Xrender.c18
1 files changed, 18 insertions, 0 deletions
diff --git a/src/Xrender.c b/src/Xrender.c
index 3102eb2..71cf3e6 100644
--- a/src/Xrender.c
+++ b/src/Xrender.c
@@ -533,12 +533,30 @@ XRenderQueryFormats (Display *dpy)
screen->fallback = _XRenderFindFormat (xri, xScreen->fallback);
screen->subpixel = SubPixelUnknown;
xDepth = (xPictDepth *) (xScreen + 1);
+ if (screen->ndepths > rep.numDepths) {
+ Xfree (xri);
+ Xfree (xData);
+ _XEatDataWords (dpy, rep.length);
+ UnlockDisplay (dpy);
+ SyncHandle ();
+ return 0;
+ }
+ rep.numDepths -= screen->ndepths;
for (nd = 0; nd < screen->ndepths; nd++)
{
depth->depth = xDepth->depth;
depth->nvisuals = xDepth->nPictVisuals;
depth->visuals = visual;
xVisual = (xPictVisual *) (xDepth + 1);
+ if (depth->nvisuals > rep.numVisuals) {
+ Xfree (xri);
+ Xfree (xData);
+ _XEatDataWords (dpy, rep.length);
+ UnlockDisplay (dpy);
+ SyncHandle ();
+ return 0;
+ }
+ rep.numVisuals -= depth->nvisuals;
for (nv = 0; nv < depth->nvisuals; nv++)
{
visual->visual = _XRenderFindVisual (dpy, xVisual->visual);