Skip to content

N
nx-libs
Commit b0695260 authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Ulrich Sibiller
Browse files
Options

unvalidated index in _XkbReadGetDeviceInfoReply() [CVE-2013-1997 2/15]

If the X server returns more buttons than are allocated in the XKB device info structures, out of bounds writes could occur. Reported-by: 's avatarIlja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: 's avatarMatthieu Herrb <matthieu.herrb@laas.fr> Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 2a1fbb18
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 0 deletions
nx-X11/lib/X11/XKBExtDev.c
View file @ b0695260
......@@ -181,6 +181,9 @@ int tmp;
return tmp;
}
if (rep->nBtnsWanted>0) {
if (((unsigned short) rep->firstBtnWanted + rep->nBtnsWanted)
>= devi->num_btns)
goto BAILOUT;
act= &devi->btn_acts[rep->firstBtnWanted];
bzero((char *)act,(rep->nBtnsWanted*sizeof(XkbAction)));
}
......@@ -190,6 +193,9 @@ int tmp;
goto BAILOUT;
if (rep->nBtnsRtrn>0) {
int size;
if (((unsigned short) rep->firstBtnRtrn + rep->nBtnsRtrn)
>= devi->num_btns)
goto BAILOUT;
act= &devi->btn_acts[rep->firstBtnRtrn];
size= rep->nBtnsRtrn*SIZEOF(xkbActionWireDesc);
if (!_XkbCopyFromReadBuffer(&buf,(char *)act,size))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment