diff options
| author | Tobias Stoeckmann <tobias@stoeckmann.org> | 2016-09-25 21:43:09 +0200 |
|---|---|---|
| committer | Matthieu Herrb <matthieu@herrb.eu> | 2016-09-25 22:15:13 +0200 |
| commit | 9362c7ddd1af3b168953d0737877bc52d79c94f4 (patch) | |
| tree | 161248ef97b1095a96bb5e701b69f928a20d3bcc | |
| parent | 8fad00b0b647ee662ce4737ca15be033b7a21714 (diff) | |
| download | xorg-lib-libXrender-9362c7ddd1af3b168953d0737877bc52d79c94f4.tar.gz | |
Validate lengths while parsing server data.
Individual lengths inside received server data can overflow
the previously reserved memory.
It is therefore important to validate every single length
field to not overflow the previously agreed sum of all invidual
length fields.
v2: consume remaining bytes in the reply buffer on error.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: Matthieu Herrb@laas.fr
| -rw-r--r-- | src/Xrender.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/src/Xrender.c b/src/Xrender.c index 3102eb2..71cf3e6 100644 --- a/src/Xrender.c +++ b/src/Xrender.c @@ -533,12 +533,30 @@ XRenderQueryFormats (Display *dpy) screen->fallback = _XRenderFindFormat (xri, xScreen->fallback); screen->subpixel = SubPixelUnknown; xDepth = (xPictDepth *) (xScreen + 1); + if (screen->ndepths > rep.numDepths) { + Xfree (xri); + Xfree (xData); + _XEatDataWords (dpy, rep.length); + UnlockDisplay (dpy); + SyncHandle (); + return 0; + } + rep.numDepths -= screen->ndepths; for (nd = 0; nd < screen->ndepths; nd++) { depth->depth = xDepth->depth; depth->nvisuals = xDepth->nPictVisuals; depth->visuals = visual; xVisual = (xPictVisual *) (xDepth + 1); + if (depth->nvisuals > rep.numVisuals) { + Xfree (xri); + Xfree (xData); + _XEatDataWords (dpy, rep.length); + UnlockDisplay (dpy); + SyncHandle (); + return 0; + } + rep.numVisuals -= depth->nvisuals; for (nv = 0; nv < depth->nvisuals; nv++) { visual->visual = _XRenderFindVisual (dpy, xVisual->visual); |