diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-13 14:33:32 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-26 19:32:10 -0700 |
| commit | 47bb28ac0e6e49d3b6eb90c7c215f2fcf54f1a95 (patch) | |
| tree | 3d32aea5479b2fadf2fb191f99c98554e59fc75d | |
| parent | 284a88e21fc05a63466115b33efa411c60d988c9 (diff) | |
memory corruption in XF86VidModeGetGammaRamp() [CVE-2013-2001]
We trusted the server not to return more data than the client said it had
allocated room for, and would overflow the provided buffers if it did.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
| -rw-r--r-- | src/XF86VMode.c | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/src/XF86VMode.c b/src/XF86VMode.c index bd54937..a32564e 100644 --- a/src/XF86VMode.c +++ b/src/XF86VMode.c @@ -1110,6 +1110,7 @@ XF86VidModeGetGammaRamp ( XExtDisplayInfo *info = find_display (dpy); xXF86VidModeGetGammaRampReq *req; xXF86VidModeGetGammaRampReply rep; + Bool result = True; XF86VidModeCheckExtension (dpy, info, False); @@ -1120,19 +1121,23 @@ XF86VidModeGetGammaRamp ( req->screen = screen; req->size = size; if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { - UnlockDisplay (dpy); - SyncHandle (); - return False; + result = False; } - if(rep.size) { - _XRead(dpy, (char*)red, rep.size << 1); - _XRead(dpy, (char*)green, rep.size << 1); - _XRead(dpy, (char*)blue, rep.size << 1); + else if (rep.size) { + if (rep.size <= size) { + _XRead(dpy, (char*)red, rep.size << 1); + _XRead(dpy, (char*)green, rep.size << 1); + _XRead(dpy, (char*)blue, rep.size << 1); + } + else { + _XEatDataWords(dpy, rep.length); + result = False; + } } UnlockDisplay(dpy); SyncHandle(); - return True; + return result; } Bool XF86VidModeGetGammaRampSize( |