Skip to content

N
nx-libs
Commit e3e4062c authored by Keith Packard's avatar Keith Packard Committed by Ulrich Sibiller
Browse files
Options

dbe: Call to DDX SwapBuffers requires address of int, not unsigned int [CVE-2014-8097 pt. 2]

When the local types used to walk the DBE request were changed, this changed the type of the parameter passed to the DDX SwapBuffers API, but there wasn't a matching change in the API definition. At this point, with the API frozen, I just stuck a new variable in with the correct type. Because we've already bounds-checked nStuff to be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will fit in a signed int without overflow. Signed-off-by: Keith Packard <keithp@keithp.com Reviewed-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 01eaab83
Show whitespace changes
Inline Side-by-side
Showing with 4 additions and 3 deletions
nx-X11/programs/Xserver/dbe/dbe.c
View file @ e3e4062c
......@@ -721,7 +721,7 @@ ProcDbeSwapBuffers(client)
int error;
unsigned int i, j;
unsigned int nStuff;
int nStuff_i; /* DDX API requires int for nStuff */
REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
nStuff = stuff->n; /* use local variable for performance. */
......@@ -806,10 +806,11 @@ ProcDbeSwapBuffers(client)
* could deal with cross-screen synchronization.
*/
while (nStuff > 0)
nStuff_i = nStuff;
while (nStuff_i > 0)
{
pDbeScreenPriv = DBE_SCREEN_PRIV_FROM_WINDOW(swapInfo[0].pWindow);
error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);
error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff_i, swapInfo);
if (error != Success)
{
free(swapInfo);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment