integer overflow in XSyncListSystemCounters() [CVE-2013-1982 6/6]

If the number of counters or amount of data reported by the server is
large enough that it overflows when multiplied by the size of the
appropriate struct, then memory corruption can occur when more bytes
are read from the X server than the size of the buffers we allocated
to hold them.

V2: Make sure we don't walk past the end of the reply when converting
data from wire format to the structures returned to the caller.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

0 files changed, 0 insertions, 0 deletions