dbe: unvalidated lengths in DbeSwapBuffers calls [CVE-2014-8097]

ProcDbeSwapBuffers() has a 32bit (n) length value that it uses to read from a buffer. The length is never validated, which can lead to out of bound reads, and possibly returning the data read from out of bounds to the misbehaving client via an X Error packet. SProcDbeSwapBuffers() swaps data (for correct endianness) before handing it off to the real proc. While doing the swapping, the length field is not validated, which can cause memory corruption. v2: reorder checks to avoid compilers optimizing out checks for overflow that happen after we'd already have done the overflowing multiplications. v3: backport to nx-libs 3.6.x (Mike DePaulo) Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Conflicts: dbe/dbe.c

dbe: unvalidated lengths in DbeSwapBuffers calls [CVE-2014-8097]
985ca320 · Alan Coopersmith · Mike Gabriel · 82d7279e · 985ca320
Commit 985ca320 authored Jan 22, 2014 by Alan Coopersmith Committed by Mike Gabriel Feb 14, 2015
Hide whitespace changes
Inline Side-by-side

Showing with 8 additions and 3 deletions

dbe.c nx-X11/programs/Xserver/dbe/dbe.c +8 -3

No files found.
--- a/nx-X11/programs/Xserver/dbe/dbe.c
+++ b/nx-X11/programs/Xserver/dbe/dbe.c
@@ -725,8 +725,8 @@ ProcDbeSwapBuffers(client)
    DbeSwapInfoPtr	swapInfo;
    xDbeSwapInfo	*dbeSwapInfo;
    int			error;
-    register int	i, j;
+    unsigned int	i, j;
-    int			nStuff;
+    unsigned int	nStuff;
    REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
@@ -734,11 +734,13 @@ ProcDbeSwapBuffers(client)
    if (nStuff == 0)
    {
+        REQUEST_SIZE_MATCH(xDbeSwapBuffersReq);
        return(Success);
    }
    if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
 	    return BadAlloc;
+    REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, nStuff * sizeof(xDbeSwapInfo));
    /* Get to the swap info appended to the end of the request. */
    dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];
@@ -1289,7 +1291,7 @@ SProcDbeSwapBuffers(client)
    ClientPtr client;
 {
    REQUEST(xDbeSwapBuffersReq);
-    register int	i, n;
+    unsigned int	i, n;
    xDbeSwapInfo	*pSwapInfo;
@@ -1297,6 +1299,9 @@ SProcDbeSwapBuffers(client)
    REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
    swapl(&stuff->n, n);
+    if (stuff->n > UINT32_MAX / sizeof(DbeSwapInfoRec))
+        return BadAlloc;
+    REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, stuff->n * sizeof(xDbeSwapInfo));
    if (stuff->n != 0)
    {