Skip to content

N
nx-libs
Commit 7564bf7e authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Ulrich Sibiller
Browse files
Options

unvalidated index in _XkbReadModifierMap() [CVE-2013-1997 8/15]

If the X server returns modifier map indexes outside the range of the number of keys it told us to allocate, out of bounds memory writes could occur. Reported-by: 's avatarIlja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: 's avatarMatthieu Herrb <matthieu.herrb@laas.fr> Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 8f2c0508
Hide whitespace changes
Inline Side-by-side
Showing with 5 additions and 0 deletions
nx-X11/lib/X11/XKBGetMap.c
View file @ 7564bf7e
...@@ -391,6 +391,9 @@ register int i; ...@@ -391,6 +391,9 @@ register int i;
unsigned char *wire; unsigned char *wire;
if ( rep->totalModMapKeys>0 ) { if ( rep->totalModMapKeys>0 ) {
if ( ((int)rep->firstModMapKey + rep->nModMapKeys) >
(xkb->max_key_code + 1))
return BadLength;
if ((xkb->map->modmap==NULL)&& if ((xkb->map->modmap==NULL)&&
(XkbAllocClientMap(xkb,XkbModifierMapMask,0)!=Success)) { (XkbAllocClientMap(xkb,XkbModifierMapMask,0)!=Success)) {
return BadAlloc; return BadAlloc;
...@@ -403,6 +406,8 @@ unsigned char *wire; ...@@ -403,6 +406,8 @@ unsigned char *wire;
if (!wire) if (!wire)
return BadLength; return BadLength;
for (i=0;i<rep->totalModMapKeys;i++,wire+=2) { for (i=0;i<rep->totalModMapKeys;i++,wire+=2) {
if (wire[0] > xkb->max_key_code || wire[1] > xkb->max_key_code)
return BadLength;
xkb->map->modmap[wire[0]]= wire[1]; xkb->map->modmap[wire[0]]= wire[1];
} }
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment