Attachment 15614 Details for Bug 15222 – 1st try at patching the issues (against server-1.4-branch)

[patch] 1st try at patching the issues (against server-1.4-branch)

idef-apr08-v1.diff (text/plain), 5.98 KB, created by Matthieu Herrb on 2008-04-01 14:42:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthieu Herrb

Created: 2008-04-01 14:42:58 UTC

Size: 5.98 KB

patch

obsolete

>diff --git a/Xext/security.c b/Xext/security.c
>index ba057de..6212997 100644
>--- a/Xext/security.c
>+++ b/Xext/security.c
>@@ -651,15 +651,18 @@ SProcSecurityGenerateAuthorization(
>     register char 	n;
>     CARD32 *values;
>     unsigned long nvalues;
>+    int values_offset;
> 
>     swaps(&stuff->length, n);
>     REQUEST_AT_LEAST_SIZE(xSecurityGenerateAuthorizationReq);
>     swaps(&stuff->nbytesAuthProto, n);
>     swaps(&stuff->nbytesAuthData, n);
>     swapl(&stuff->valueMask, n);
>-    values = (CARD32 *)(&stuff[1]) +
>-	((stuff->nbytesAuthProto + (unsigned)3) >> 2) +
>-	((stuff->nbytesAuthData + (unsigned)3) >> 2);
>+    values_offset = ((stuff->nbytesAuthProto + (unsigned)3) >> 2) +
>+		    ((stuff->nbytesAuthData + (unsigned)3) >> 2);
>+    if (values_offset > stuff->length - (sz_xSecurityQueryVersionReq >> 2))
>+	return BadLength;
>+    values = (CARD32 *)(&stuff[1]) + values_offset;
>     nvalues = (((CARD32 *)stuff) + stuff->length) - values;
>     SwapLongs(values, nvalues);
>     return ProcSecurityGenerateAuthorization(client);
>diff --git a/record/record.c b/record/record.c
>index 0ed8f84..9a166d6 100644
>--- a/record/record.c
>+++ b/record/record.c
>@@ -2656,7 +2656,7 @@ SProcRecordQueryVersion(ClientPtr client)
> } /* SProcRecordQueryVersion */
> 
> 
>-static void
>+static int
> SwapCreateRegister(xRecordRegisterClientsReq *stuff)
> {
>     register char n;
>@@ -2667,11 +2667,17 @@ SwapCreateRegister(xRecordRegisterClientsReq *stuff)
>     swapl(&stuff->nClients, n);
>     swapl(&stuff->nRanges, n);
>     pClientID = (XID *)&stuff[1];
>+    if (stuff->nClients > stuff->length - (sz_xRecordRegisterClientsReq >> 2))
>+	return BadLength;
>     for (i = 0; i < stuff->nClients; i++, pClientID++)
>     {
> 	swapl(pClientID, n);
>     }
>+    if (stuff->nRanges > stuff->length - (sz_xRecordRegisterClientsReq >> 2)
>+	- stuff->nClients)
>+	return BadLength;
>     RecordSwapRanges((xRecordRange *)pClientID, stuff->nRanges);
>+    return Success;
> } /* SwapCreateRegister */
> 
> 
>@@ -2679,11 +2685,13 @@ static int
> SProcRecordCreateContext(ClientPtr client)
> {
>     REQUEST(xRecordCreateContextReq);
>+    int			status;
>     register char 	n;
> 
>     swaps(&stuff->length, n);
>     REQUEST_AT_LEAST_SIZE(xRecordCreateContextReq);
>-    SwapCreateRegister((pointer)stuff);
>+    if ((status = SwapCreateRegister((pointer)stuff)) != Success)
>+	return status;
>     return ProcRecordCreateContext(client);
> } /* SProcRecordCreateContext */
> 
>@@ -2692,11 +2700,13 @@ static int
> SProcRecordRegisterClients(ClientPtr client)
> {
>     REQUEST(xRecordRegisterClientsReq);
>+    int			status;
>     register char 	n;
> 
>     swaps(&stuff->length, n);
>     REQUEST_AT_LEAST_SIZE(xRecordRegisterClientsReq);
>-    SwapCreateRegister((pointer)stuff);
>+    if ((status = SwapCreateRegister((pointer)stuff)) != Success)
>+	return status;
>     return ProcRecordRegisterClients(client);
> } /* SProcRecordRegisterClients */
> 
>diff --git a/render/glyph.c b/render/glyph.c
>index 583a52b..7bf3294 100644
>--- a/render/glyph.c
>+++ b/render/glyph.c
>@@ -626,8 +626,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
>     int		     size;
>     GlyphPtr	     glyph;
>     int		     i;
>-
>-    size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
>+    size_t	     padded_width;
>+    
>+    padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
>+    if (padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
>+	return 0;
>+    size = gi->height * padded_width;
>     glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
>     if (!glyph)
> 	return 0;
>diff --git a/render/render.c b/render/render.c
>index caaa278..9f60de0 100644
>--- a/render/render.c
>+++ b/render/render.c
>@@ -1504,6 +1504,8 @@ ProcRenderCreateCursor (ClientPtr client)
>     pScreen = pSrc->pDrawable->pScreen;
>     width = pSrc->pDrawable->width;
>     height = pSrc->pDrawable->height;
>+    if (width > UINT32_MAX/(height*sizeof(CARD32)))
>+	return BadAlloc;
>     if ( stuff->x > width 
>       || stuff->y > height )
> 	return (BadMatch);
>@@ -1918,6 +1920,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
>     LEGAL_NEW_RESOURCE(stuff->pid, client);
> 
>     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
>+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
>+	return BadLength;
>     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
>         return BadLength;
> 
>@@ -2491,18 +2495,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
>     return (*ProcRenderVector[stuff->renderReqType]) (client);
> }
> 
>-static void swapStops(void *stuff, int n)
>+static void swapStops(void *stuff, int num)
> {
>-    int i;
>+    int i, n;
>     CARD32 *stops;
>     CARD16 *colors;
>     stops = (CARD32 *)(stuff);
>-    for (i = 0; i < n; ++i) {
>+    for (i = 0; i < num; ++i) {
>         swapl(stops, n);
>         ++stops;
>     }
>     colors = (CARD16 *)(stops);
>-    for (i = 0; i < 4*n; ++i) {
>+    for (i = 0; i < 4*num; ++i) {
>         swaps(stops, n);
>         ++stops;
>     }
>@@ -2525,6 +2529,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
>     swapl(&stuff->nStops, n);
> 
>     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
>+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
>+	return BadLength;
>     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
>         return BadLength;
> 
>@@ -2552,6 +2558,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
>     swapl(&stuff->nStops, n);
> 
>     len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
>+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
>+	return BadLength;
>     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
>         return BadLength;
> 
>@@ -2576,6 +2584,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
>     swapl(&stuff->nStops, n);
> 
>     len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
>+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
>+	return BadLength;
>     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
>         return BadLength;
>

Actions: View | Splinter Review

Attachments on bug 15222: 15497 | 15498 | 15499 | 15500 | 15614 | 16341 | 16473 | 16477 | 16478 | 16513 | 16793

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.