qbit/xenocara
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge from upstream X.Org : Fix size calculation in _XimAttributeToValue

Browse Source 
The check here guards the read below.

For `XimType_XIMStyles`, these are `num` of `CARD32` and for
`XimType_XIMHotKeyTriggers` these are `num` of `XIMTRIGGERKEY` ref[1]
which is defined as 3 x `CARD32`.  (There are data after the
`XIMTRIGGERKEY` according to the spec but they are not read by this
function and doesn't need to be checked.)

The old code here used the native datatype size instead of the wire
protocol size causing the check to always fail.

Also fix the size calculation for the header (size). It is 2 x CARD16
for both types despite the unused `CARD16` for `XimType_XIMStyles`.

This fixes a regression caused by previous commit.
This commit is contained in:
matthieu 2020-08-06 14:28:54 +00:00
parent 044da0a592
commit 4c672aa51a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/libX11/modules/im/ximcp/imRmAttr.c
View File

@ -265,7 +265,7 @@ _XimAttributeToValue(
if (num > (USHRT_MAX / sizeof(XIMStyle)))
return False;
if ((sizeof(num) + (num * sizeof(XIMStyle))) > data_len)
if ((2 * sizeof(CARD16) + (num * sizeof(CARD32))) > data_len)
return False;
alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num;
if (alloc_len < sizeof(XIMStyles))
@ -379,7 +379,7 @@ _XimAttributeToValue(
if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger)))
return False;
if ((sizeof(num) + (num * sizeof(XIMHotKeyTrigger))) > data_len)
if ((2 * sizeof(CARD16) + (num * 3 * sizeof(CARD32))) > data_len)
return False;
alloc_len = sizeof(XIMHotKeyTriggers)
+ sizeof(XIMHotKeyTrigger) * num;