diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-03-10 00:22:14 -0800 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2013-05-24 11:46:37 +1000 |
| commit | f888a17af24945e2b583625c7d85ebed1518fc05 (patch) | |
| tree | e381e04ed29930a71950c4487f5b7d3d30a4cf01 | |
| parent | 7be9dcc311e29ed326e53117904648cb51ee21df (diff) | |
| download | xorg-lib-libXi-f888a17af24945e2b583625c7d85ebed1518fc05.tar.gz | |
Avoid integer overflow in XListInputDevices() [CVE-2013-1984 8/8]
If the length of the reply as reported by the Xserver is too long, it
could overflow the calculation for the size of the buffer to copy the
reply into, causing memory corruption.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit ef82512288d8ca36ac0beeb289f158195b0a8cae)
| -rw-r--r-- | src/XListDev.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/src/XListDev.c b/src/XListDev.c index 6687c2a..71dbd95 100644 --- a/src/XListDev.c +++ b/src/XListDev.c @@ -60,6 +60,7 @@ SOFTWARE. #include <X11/extensions/XInput.h> #include <X11/extensions/extutil.h> #include "XIint.h" +#include <limits.h> /* Calculate length field to a multiples of sizeof(XID). XIDs are typedefs * to ulong and thus may be 8 bytes on some platforms. This can trigger a @@ -178,7 +179,7 @@ XListInputDevices( XAnyClassPtr Any; char *nptr, *Nptr; int i; - long rlen; + unsigned long rlen; XExtDisplayInfo *info = XInput_find_display(dpy); LockDisplay(dpy); @@ -197,9 +198,10 @@ XListInputDevices( if ((*ndevices = rep.ndevices)) { /* at least 1 input device */ size = *ndevices * sizeof(XDeviceInfo); - rlen = rep.length << 2; /* multiply length by 4 */ - list = (xDeviceInfo *) Xmalloc(rlen); - slist = list; + if (rep.length < (INT_MAX >> 2)) { + rlen = rep.length << 2; /* multiply length by 4 */ + slist = list = Xmalloc(rlen); + } if (!slist) { _XEatDataWords(dpy, rep.length); UnlockDisplay(dpy); |