Attachment 36586 Details for Bug 28801 – 0001-render-Bounds-check-for-nglyphs-in-ProcRenderAddGlyp.patch

[patch] 0001-render-Bounds-check-for-nglyphs-in-ProcRenderAddGlyp.patch

0001-render-Bounds-check-for-nglyphs-in-ProcRenderAddGlyp.patch (text/plain), 1005 bytes, created by Adam Jackson on 2010-06-28 15:22:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adam Jackson

Created: 2010-06-28 15:22:04 UTC

Size: 1005 bytes

patch

obsolete

>From 0ef73fcc9565a083be2f8ad401b686fdaf122635 Mon Sep 17 00:00:00 2001
>From: Adam Jackson <ajax@redhat.com>
>Date: Mon, 28 Jun 2010 18:08:50 -0400
>Subject: [PATCH] render: Bounds check for nglyphs in ProcRenderAddGlyphs (#28801)
>
>Signed-off-by: Adam Jackson <ajax@redhat.com>
>---
> render/render.c |    8 ++++++++
> 1 files changed, 8 insertions(+), 0 deletions(-)
>
>diff --git a/render/render.c b/render/render.c
>index ef233e4..00241f9 100644
>--- a/render/render.c
>+++ b/render/render.c
>@@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client)
>     gi = (xGlyphInfo *) (gids + nglyphs);
>     bits = (CARD8 *) (gi + nglyphs);
>     remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
>+
>+    /* protect against bad nglyphs */
>+    if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
>+        bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
>+        err = BadLength;
>+        goto bail;
>+    }
>+
>     for (i = 0; i < nglyphs; i++)
>     {
> 	size_t padded_width;
>-- 
>1.7.0.1
>

Actions: View | Splinter Review

Attachments on bug 28801: 36586 | 36613

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.