1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
From c480fe3271873ec7471b0cbd680f4dac18ca8904 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 13 Apr 2013 17:24:08 +0000
Subject: integer overflow in XFixesGetCursorImage() [CVE-2013-1983]
If the reported cursor dimensions or name length are too large, the
calculations to allocate memory for them may overflow, leaving us
writing beyond the bounds of the allocation.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
diff --git a/src/Cursor.c b/src/Cursor.c
index 641b747..33590b7 100644
--- a/src/Cursor.c
+++ b/src/Cursor.c
@@ -47,6 +47,7 @@
#include <config.h>
#endif
#include "Xfixesint.h"
+#include <limits.h>
void
XFixesSelectCursorInput (Display *dpy,
@@ -74,9 +75,9 @@ XFixesGetCursorImage (Display *dpy)
XFixesExtDisplayInfo *info = XFixesFindDisplay (dpy);
xXFixesGetCursorImageAndNameReq *req;
xXFixesGetCursorImageAndNameReply rep;
- int npixels;
- int nbytes_name;
- int nbytes, nread, rlength;
+ size_t npixels;
+ size_t nbytes_name;
+ size_t nbytes, nread, rlength;
XFixesCursorImage *image;
char *name;
@@ -101,16 +102,21 @@ XFixesGetCursorImage (Display *dpy)
}
npixels = rep.width * rep.height;
nbytes_name = rep.nbytes;
- /* reply data length */
- nbytes = (long) rep.length << 2;
- /* bytes of actual data in the reply */
- nread = (npixels << 2) + nbytes_name;
- /* size of data returned to application */
- rlength = (sizeof (XFixesCursorImage) +
- npixels * sizeof (unsigned long) +
- nbytes_name + 1);
+ if ((rep.length < (INT_MAX >> 2)) &&
+ npixels < (((INT_MAX >> 3) - sizeof (XFixesCursorImage) - 1)
+ - nbytes_name)) {
+ /* reply data length */
+ nbytes = (size_t) rep.length << 2;
+ /* bytes of actual data in the reply */
+ nread = (npixels << 2) + nbytes_name;
+ /* size of data returned to application */
+ rlength = (sizeof (XFixesCursorImage) +
+ npixels * sizeof (unsigned long) +
+ nbytes_name + 1);
- image = (XFixesCursorImage *) Xmalloc (rlength);
+ image = Xmalloc (rlength);
+ } else
+ image = NULL;
if (!image)
{
_XEatDataWords(dpy, rep.length);
--
cgit v0.9.0.2-2-gbebe
|
