Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP5:Update
tigervnc.13718
u_tigervnc-cve-2014-8240.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File u_tigervnc-cve-2014-8240.patch of Package tigervnc.13718
Patch-Mainline: To be upstreamed References: bnc#900896 CVE-2014-8240 Signed-off-by: Michal Srb <msrb@suse.com> Index: tigervnc-1.8.0/unix/x0vncserver/Image.cxx =================================================================== --- tigervnc-1.8.0.orig/unix/x0vncserver/Image.cxx +++ tigervnc-1.8.0/unix/x0vncserver/Image.cxx @@ -80,6 +80,14 @@ void Image::Init(int width, int height) xim = XCreateImage(dpy, vis, DefaultDepth(dpy, DefaultScreen(dpy)), ZPixmap, 0, 0, width, height, BitmapPad(dpy), 0); + if (xim->bytes_per_line <= 0 || + xim->height <= 0 || + xim->height >= INT_MAX / xim->bytes_per_line) { + vlog.error("Invalid display size"); + XDestroyImage(xim); + exit(1); + } + xim->data = (char *)malloc(xim->bytes_per_line * xim->height); if (xim->data == NULL) { vlog.error("malloc() failed"); @@ -254,6 +262,17 @@ void ShmImage::Init(int width, int heigh delete shminfo; shminfo = NULL; return; + } + + if (xim->bytes_per_line <= 0 || + xim->height <= 0 || + xim->height >= INT_MAX / xim->bytes_per_line) { + vlog.error("Invalid display size"); + XDestroyImage(xim); + xim = NULL; + delete shminfo; + shminfo = NULL; + return; } shminfo->shmid = shmget(IPC_PRIVATE,
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor