diff options
| author | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2013-06-10 19:21:21 +0000 |
|---|---|---|
| committer | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2013-06-10 19:21:21 +0000 |
| commit | f7c00089e4a73c3e1898b932a9af9e321334d32c (patch) | |
| tree | 5262fab2f8ba9634c60d055c624c2b3a3e1774da | |
| parent | 4718d0fc5b82219d601ea3d9d6a9090df87ca5eb (diff) | |
Fixes from upstreams for vulnerabilities reported by Ilja Van Sprundel
Integer overflow in XF86DRIOpenConnection() and
XF86DRIGetClientDriverName() [CVE-2013-1993]
Reminded by jsg@. Thanks
| -rw-r--r-- | dist/Mesa/src/glx/XF86dri.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/dist/Mesa/src/glx/XF86dri.c b/dist/Mesa/src/glx/XF86dri.c index 5c181d6db..b73cda175 100644 --- a/dist/Mesa/src/glx/XF86dri.c +++ b/dist/Mesa/src/glx/XF86dri.c @@ -43,6 +43,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. #include <X11/extensions/Xext.h> #include <X11/extensions/extutil.h> #include "xf86dristr.h" +#include <limits.h> static XExtensionInfo _xf86dri_info_data; static XExtensionInfo *xf86dri_info = &_xf86dri_info_data; @@ -201,7 +202,11 @@ XF86DRIOpenConnection(Display * dpy, int screen, drm_handle_t * hSAREA, } if (rep.length) { - if (!(*busIdString = (char *) Xcalloc(rep.busIdStringLength + 1, 1))) { + if (rep.busIdStringLength < INT_MAX) + *busIdString = Xcalloc(rep.busIdStringLength + 1, 1); + else + *busIdString = NULL; + if (*busIdString == NULL) { _XEatData(dpy, ((rep.busIdStringLength + 3) & ~3)); UnlockDisplay(dpy); SyncHandle(); @@ -300,9 +305,11 @@ XF86DRIGetClientDriverName(Display * dpy, int screen, *ddxDriverPatchVersion = rep.ddxDriverPatchVersion; if (rep.length) { - if (! - (*clientDriverName = - (char *) Xcalloc(rep.clientDriverNameLength + 1, 1))) { + if (rep.clientDriverNameLength < INT_MAX) + *clientDriverName = Xcalloc(rep.clientDriverNameLength + 1, 1); + else + *clientDriverName = NULL; + if (*clientDriverName == NULL) { _XEatData(dpy, ((rep.clientDriverNameLength + 3) & ~3)); UnlockDisplay(dpy); SyncHandle(); |