configure.ac | 2 +-
src/Region.c | 15 ++++++++++++---
2 files changed, 13 insertions(+), 4 deletions(-)
New commits:
commit 84df9cb81cc31bbed27ba241a23ae04f61da57db
Author: Matthieu Herrb <matthieu.he...@laas.fr>
Date: Tue Oct 4 21:11:55 2016 +0200
libXfixes 5.0.3
Signed-off-by: Matthieu Herrb <matthieu.he...@laas.fr>
diff --git a/configure.ac b/configure.ac
index a9052cf..0ec7b86 100644
--- a/configure.ac
+++ b/configure.ac
@@ -32,7 +32,7 @@ AC_PREREQ([2.60])
# that 'revision' number appears in Xfixes.h and has to be manually
# synchronized.
#
-AC_INIT(libXfixes, [5.0.2],
+AC_INIT(libXfixes, [5.0.3],
[https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libXfixes])
AC_CONFIG_SRCDIR([Makefile.am])
AC_CONFIG_HEADERS([config.h])
commit 61c1039ee23a2d1de712843bed3480654d7ef42e
Author: Tobias Stoeckmann <tob...@stoeckmann.org>
Date: Sun Sep 25 22:38:44 2016 +0200
Integer overflow on illegal server response
The 32 bit field "rep.length" is not checked for validity, which allows
an integer overflow on 32 bit systems.
A malicious server could send INT_MAX as length, which gets multiplied
by the size of XRectangle. In that case the client won't read the whole
data from server, getting out of sync.
Signed-off-by: Tobias Stoeckmann <tob...@stoeckmann.org>
Reviewed-by: Matthieu Herrb <matth...@herrb.eu>
diff --git a/src/Region.c b/src/Region.c
index cb0cf6e..59bcc1a 100644
--- a/src/Region.c
+++ b/src/Region.c
@@ -23,6 +23,7 @@
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include "Xfixesint.h"
XserverRegion
@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy,
bounds->y = rep.y;
bounds->width = rep.width;
bounds->height = rep.height;
- nbytes = (long) rep.length << 2;
- nrects = rep.length >> 1;
- rects = Xmalloc (nrects * sizeof (XRectangle));
+
+ if (rep.length < (INT_MAX >> 2)) {
+ nbytes = (long) rep.length << 2;
+ nrects = rep.length >> 1;
+ rects = Xmalloc (nrects * sizeof (XRectangle));
+ } else {
+ nbytes = 0;
+ nrects = 0;
+ rects = NULL;
+ }
+
if (!rects)
{
_XEatDataWords(dpy, rep.length);
