File U_0003-integer-overflow-in-XGetDeviceDontPropag... of Package xorg-x11-libs

Overview Repositories Revisions Requests Users Attributes Meta

File U_0003-integer-overflow-in-XGetDeviceDontPropagateList-CVE-.patch of Package xorg-x11-libs

From 6dd6dc51a2935c72774be81e5cc2ba2c30e9feff Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 9 Mar 2013 22:55:23 -0800
Subject: [PATCH] integer overflow in XGetDeviceDontPropagateList()
 [CVE-2013-1984 3/8]

If the number of event classes reported by the server is large enough
that it overflows when multiplied by the size of the appropriate struct,
then memory corruption can occur when more bytes are copied from the
X server reply than the size of the buffer we allocated to hold them.

V2: EatData if count is 0 but length is > 0 to avoid XIOErrors

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 src/XGetProp.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

Index: libXi-1.2.1/src/XGetProp.c
===================================================================
--- libXi-1.2.1.orig/src/XGetProp.c
+++ libXi-1.2.1/src/XGetProp.c
@@ -60,6 +60,7 @@ SOFTWARE.
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
+#include <limits.h>
 
 XEventClass *
 XGetDeviceDontPropagateList(dpy, window, count)
@@ -90,9 +91,10 @@ Window window;
     }
     *count = rep.count;
 
-    if (*count) {
+    if (rep.length != 0) {
+	if ((rep.count != 0) && (rep.length < (INT_MAX / sizeof(XEventClass))))
+	    list = Xmalloc(rep.length * sizeof(XEventClass));
 	rlen = rep.length << 2;
-	list = (XEventClass *) Xmalloc(rep.length * sizeof(XEventClass));
 	if (list) {
 	    int i;
 	    CARD32 ec;

Places

File U_0003-integer-overflow-in-XGetDeviceDontPropagateList-CVE-.patch of Package xorg-x11-libs

Places