qbit/xenocara
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

The validation of server responses avoids out of boundary accesses.

Browse Source 
From Tobias Stoeckmann / Xorg Securiry adrvisory Oct 4, 2016.
This commit is contained in:
matthieu 2016-10-04 14:56:37 +00:00
parent cdbe6c3bc9
commit bd2560e2ec
3 changed files with 27 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
lib/libX11/src/FontNames.c
View File

@ -66,7 +66,7 @@ int *actualCount) /* RETURN */
if (rep.nFonts) {
flist = Xmalloc (rep.nFonts * sizeof(char *));
if (rep.length < (INT_MAX >> 2)) {
if (rep.length > 0 && rep.length < (INT_MAX >> 2)) {
rlen = rep.length << 2;
ch = Xmalloc(rlen + 1);
/* +1 to leave room for last null-terminator */
@ -93,11 +93,22 @@ int *actualCount) /* RETURN */
if (ch + length < chend) {
flist[i] = ch + 1; /* skip over length */
ch += length + 1; /* find next length ... */
length = *(unsigned char *)ch;
*ch = '\0'; /* and replace with null-termination */
count++;
} else
flist[i] = NULL;
if (ch <= chend) {
length = *(unsigned char *)ch;
*ch = '\0'; /* and replace with null-termination */
count++;
} else {
Xfree(flist);
flist = NULL;
count = 0;
break;
}
} else {
Xfree(flist);
flist = NULL;
count = 0;
break;
}
}
}
*actualCount = count;

12
lib/libX11/src/ListExt.c
View File

@ -55,7 +55,7 @@ char **XListExtensions(
if (rep.nExtensions) {
list = Xmalloc (rep.nExtensions * sizeof (char *));
if (rep.length < (INT_MAX >> 2)) {
if (rep.length > 0 && rep.length < (INT_MAX >> 2)) {
rlen = rep.length << 2;
ch = Xmalloc (rlen + 1);
/* +1 to leave room for last null-terminator */
@ -80,9 +80,13 @@ char **XListExtensions(
if (ch + length < chend) {
list[i] = ch+1; /* skip over length */
ch += length + 1; /* find next length ... */
length = *ch;
*ch = '\0'; /* and replace with null-termination */
count++;
if (ch <= chend) {
length = *ch;
*ch = '\0'; /* and replace with null-termination */
count++;
} else {
list[i] = NULL;
}
} else
list[i] = NULL;
}

3
lib/libX11/src/ModMap.c
View File

@ -42,7 +42,8 @@ XGetModifierMapping(register Display *dpy)
GetEmptyReq(GetModifierMapping, req);
(void) _XReply (dpy, (xReply *)&rep, 0, xFalse);
if (rep.length < (INT_MAX >> 2)) {
if (rep.length < (INT_MAX >> 2) &&
(rep.length >> 1) == rep.numKeyPerModifier) {
nbytes = (unsigned long)rep.length << 2;
res = Xmalloc(sizeof (XModifierKeymap));
if (res)