1ef33079b3
The patches where not ported to 1.7.7 so mark it forbidden. This version is not default anymore and will be removed in the 1.14 update that currently being tested. Obtained from: xserver upstream MFH: 2014Q4 Security: 27b9b2f0-8081-11e4-b4ca-bcaec565249c
34 lines
1.1 KiB
Text
34 lines
1.1 KiB
Text
From e0e11644622a589129a01e11e5d105dc74a098de Mon Sep 17 00:00:00 2001
|
|
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
Date: Wed, 22 Jan 2014 23:44:46 -0800
|
|
Subject: [PATCH 04/40] dix: integer overflow in REQUEST_FIXED_SIZE()
|
|
[CVE-2014-8092 4/4]
|
|
|
|
Force use of 64-bit integers when evaluating data provided by clients
|
|
in 32-bit fields which can overflow when added or multiplied during
|
|
checks.
|
|
|
|
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
|
|
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
---
|
|
include/dix.h | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/include/dix.h b/include/dix.h
|
|
index 991a3ce..e0c6ed8 100644
|
|
--- include/dix.h
|
|
+++ include/dix.h
|
|
@@ -76,7 +76,8 @@ SOFTWARE.
|
|
|
|
#define REQUEST_FIXED_SIZE(req, n)\
|
|
if (((sizeof(req) >> 2) > client->req_len) || \
|
|
- (((sizeof(req) + (n) + 3) >> 2) != client->req_len)) \
|
|
+ ((n >> 2) >= client->req_len) || \
|
|
+ ((((uint64_t) sizeof(req) + (n) + 3) >> 2) != (uint64_t) client->req_len)) \
|
|
return(BadLength)
|
|
|
|
#define LEGAL_NEW_RESOURCE(id,client)\
|
|
--
|
|
2.1.2
|
|
|