1665N/AFrom 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001

1665N/AFrom: Tobias Stoeckmann <tobias@stoeckmann.org>

1665N/ADate: Sun, 25 Sep 2016 22:38:44 +0200

1665N/ASubject: [PATCH:libXfixes] Integer overflow on illegal server response

1665N/A

1665N/AThe 32 bit field "rep.length" is not checked for validity, which allows

1665N/Aan integer overflow on 32 bit systems.

1665N/A

1665N/AA malicious server could send INT_MAX as length, which gets multiplied

1665N/Aby the size of XRectangle. In that case the client won't read the whole

1665N/Adata from server, getting out of sync.

1665N/A

1665N/ASigned-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

1665N/AReviewed-by: Matthieu Herrb <matthieu@herrb.eu>

1665N/A---

1665N/A src/Region.c | 15 ++++++++++++---

1665N/A 1 file changed, 12 insertions(+), 3 deletions(-)

1665N/A

1665N/Adiff --git a/src/Region.c b/src/Region.c

1665N/Aindex cb0cf6e..59bcc1a 100644

1665N/A--- a/src/Region.c

1665N/A+++ b/src/Region.c

1665N/A@@ -23,6 +23,7 @@

1665N/A #ifdef HAVE_CONFIG_H

1665N/A #include <config.h>

1665N/A #endif

1665N/A+#include <limits.h>

1665N/A #include "Xfixesint.h"

1665N/A

1665N/A XserverRegion

1665N/A@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy,

1665N/A bounds->y = rep.y;

1665N/A bounds->width = rep.width;

1665N/A bounds->height = rep.height;

1665N/A- nbytes = (long) rep.length << 2;

1665N/A- nrects = rep.length >> 1;

1665N/A- rects = Xmalloc (nrects * sizeof (XRectangle));

1665N/A+

1665N/A+ if (rep.length < (INT_MAX >> 2)) {

1665N/A+ nbytes = (long) rep.length << 2;

1665N/A+ nrects = rep.length >> 1;

1665N/A+ rects = Xmalloc (nrects * sizeof (XRectangle));

1665N/A+ } else {

1665N/A+ nbytes = 0;

1665N/A+ nrects = 0;

1665N/A+ rects = NULL;

1665N/A+ }

1665N/A+

1665N/A if (!rects)

1665N/A {

1665N/A _XEatDataWords(dpy, rep.length);

1665N/A--

1665N/A2.7.4

1665N/A