summaryrefslogtreecommitdiffstats
path: root/patches/source/xorg-server/patch/xorg-server/0026-glx-Request-length-checks-for-SetClientInfoARB-CVE-2.patch
diff options
context:
space:
mode:
Diffstat (limited to 'patches/source/xorg-server/patch/xorg-server/0026-glx-Request-length-checks-for-SetClientInfoARB-CVE-2.patch')
-rw-r--r--patches/source/xorg-server/patch/xorg-server/0026-glx-Request-length-checks-for-SetClientInfoARB-CVE-2.patch75
1 files changed, 75 insertions, 0 deletions
diff --git a/patches/source/xorg-server/patch/xorg-server/0026-glx-Request-length-checks-for-SetClientInfoARB-CVE-2.patch b/patches/source/xorg-server/patch/xorg-server/0026-glx-Request-length-checks-for-SetClientInfoARB-CVE-2.patch
new file mode 100644
index 00000000..29c18961
--- /dev/null
+++ b/patches/source/xorg-server/patch/xorg-server/0026-glx-Request-length-checks-for-SetClientInfoARB-CVE-2.patch
@@ -0,0 +1,75 @@
+From 84f275b466fa69d14d91b2ad1353d05f642d3808 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Mon, 10 Nov 2014 12:13:45 -0500
+Subject: [PATCH 26/31] glx: Request length checks for SetClientInfoARB
+ [CVE-2014-8098 5/8]
+
+Reviewed-by: Keith Packard <keithp@keithp.com>
+Reviewed-by: Julien Cristau <jcristau@debian.org>
+Reviewed-by: Michal Srb <msrb@suse.com>
+Reviewed-by: Andy Ritger <aritger@nvidia.com>
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Signed-off-by: Fedora X Ninjas <x@fedoraproject.org>
+---
+ glx/clientinfo.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/glx/clientinfo.c b/glx/clientinfo.c
+index 4aaa4c9..c5fef30 100644
+--- a/glx/clientinfo.c
++++ b/glx/clientinfo.c
+@@ -33,18 +33,21 @@ static int
+ set_client_info(__GLXclientState * cl, xGLXSetClientInfoARBReq * req,
+ unsigned bytes_per_version)
+ {
++ ClientPtr client = cl->client;
+ char *gl_extensions;
+ char *glx_extensions;
+
++ REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
++
+ /* Verify that the size of the packet matches the size inferred from the
+ * sizes specified for the various fields.
+ */
+- const unsigned expected_size = sz_xGLXSetClientInfoARBReq
+- + (req->numVersions * bytes_per_version)
+- + __GLX_PAD(req->numGLExtensionBytes)
+- + __GLX_PAD(req->numGLXExtensionBytes);
++ int size = sz_xGLXSetClientInfoARBReq;
++ size = safe_add(size, safe_mul(req->numVersions, bytes_per_version));
++ size = safe_add(size, safe_pad(req->numGLExtensionBytes));
++ size = safe_add(size, safe_pad(req->numGLXExtensionBytes));
+
+- if (req->length != (expected_size / 4))
++ if (size < 0 || req->length != (size / 4))
+ return BadLength;
+
+ /* Verify that the actual length of the GL extension string matches what's
+@@ -80,8 +83,11 @@ __glXDisp_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
+ int
+ __glXDispSwap_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
+
++ REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
++
+ req->length = bswap_16(req->length);
+ req->numVersions = bswap_32(req->numVersions);
+ req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
+@@ -99,8 +105,11 @@ __glXDisp_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
+ int
+ __glXDispSwap_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
+
++ REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
++
+ req->length = bswap_16(req->length);
+ req->numVersions = bswap_32(req->numVersions);
+ req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
+--
+1.9.3
+