summaryrefslogtreecommitdiffstats
path: root/patches/source/xorg-server/patch/xorg-server/0012-render-check-request-size-before-reading-it-CVE-2014.patch
diff options
context:
space:
mode:
Diffstat (limited to 'patches/source/xorg-server/patch/xorg-server/0012-render-check-request-size-before-reading-it-CVE-2014.patch')
-rw-r--r--patches/source/xorg-server/patch/xorg-server/0012-render-check-request-size-before-reading-it-CVE-2014.patch37
1 files changed, 37 insertions, 0 deletions
diff --git a/patches/source/xorg-server/patch/xorg-server/0012-render-check-request-size-before-reading-it-CVE-2014.patch b/patches/source/xorg-server/patch/xorg-server/0012-render-check-request-size-before-reading-it-CVE-2014.patch
new file mode 100644
index 00000000..5984f54e
--- /dev/null
+++ b/patches/source/xorg-server/patch/xorg-server/0012-render-check-request-size-before-reading-it-CVE-2014.patch
@@ -0,0 +1,37 @@
+From ae07a61a956c1f0ec57502cc50fbab50c78fc675 Mon Sep 17 00:00:00 2001
+From: Julien Cristau <jcristau@debian.org>
+Date: Tue, 28 Oct 2014 10:30:04 +0100
+Subject: [PATCH 12/31] render: check request size before reading it
+ [CVE-2014-8100 1/2]
+
+Otherwise we may be reading outside of the client request.
+
+Signed-off-by: Julien Cristau <jcristau@debian.org>
+Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Signed-off-by: Fedora X Ninjas <x@fedoraproject.org>
+---
+ render/render.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/render/render.c b/render/render.c
+index 51f75ae..ce03b13 100644
+--- a/render/render.c
++++ b/render/render.c
+@@ -276,11 +276,11 @@ ProcRenderQueryVersion(ClientPtr client)
+
+ REQUEST(xRenderQueryVersionReq);
+
++ REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
++
+ pRenderClient->major_version = stuff->majorVersion;
+ pRenderClient->minor_version = stuff->minorVersion;
+
+- REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
+-
+ if ((stuff->majorVersion * 1000 + stuff->minorVersion) <
+ (SERVER_RENDER_MAJOR_VERSION * 1000 + SERVER_RENDER_MINOR_VERSION)) {
+ rep.majorVersion = stuff->majorVersion;
+--
+1.9.3
+