From dcb6742eea1e709aa1cc6d5cbbcfb5b060bb067c Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sat, 9 Mar 2013 22:55:23 -0800 Subject: [PATCH 11/16] integer overflow in XIGetProperty() [CVE-2013-1984 5/8] If the number of items reported by the server is large enough that it overflows when multiplied by the size of the appropriate item type, then memory corruption can occur when more bytes are copied from the X server reply than the size of the buffer we allocated to hold them. Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer (cherry picked from commit 242f92b490a695fbab244af5bad11b71f897c732) (cherry picked from commit 6d992e2b31f58e716e63f9a1e5d910a66f51a11b) --- src/XIProperties.c | 11 +++++++---- 1 files changed, 7 insertions(+), 4 deletions(-) diff --git a/src/XIProperties.c b/src/XIProperties.c index 5e58fb6..32436d1 100644 --- a/src/XIProperties.c +++ b/src/XIProperties.c @@ -38,6 +38,7 @@ #include #include #include "XIint.h" +#include Atom* XIListProperties(Display* dpy, int deviceid, int *num_props_return) @@ -170,7 +171,7 @@ XIGetProperty(Display* dpy, int deviceid, Atom property, long offset, { xXIGetPropertyReq *req; xXIGetPropertyReply rep; - long nbytes, rbytes; + unsigned long nbytes, rbytes; XExtDisplayInfo *info = XInput_find_display(dpy); @@ -216,9 +217,11 @@ XIGetProperty(Display* dpy, int deviceid, Atom property, long offset, * recopy the string to make it null terminated. */ - nbytes = rep.num_items * rep.format/8; - rbytes = nbytes + 1; - *data = Xmalloc(rbytes); + if (rep.num_items < (INT_MAX / (rep.format/8))) { + nbytes = rep.num_items * rep.format/8; + rbytes = nbytes + 1; + *data = Xmalloc(rbytes); + } if (!(*data)) { _XEatDataWords(dpy, rep.length); -- 1.7.7.1