• Alan Coopersmith's avatar
    Xi: unvalidated lengths in Xinput extension [CVE-2014-8095] · fde1375e
    Alan Coopersmith authored
    Multiple functions in the Xinput extension handling of requests from
    clients failed to check that the length of the request sent by the
    client was large enough to perform all the required operations and
    thus could read or write to memory outside the bounds of the request
    buffer.
    
    This commit includes the creation of a new REQUEST_AT_LEAST_EXTRA_SIZE
    macro in include/dix.h for the common case of needing to ensure a
    request is large enough to include both the request itself and a
    minimum amount of extra data following the request header.
    
    v2: backport to nx-libs 3.6.x (Mike DePaulo)
    Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: 's avatarPeter Hutterer <peter.hutterer@who-t.net>
    
    Conflicts:
    	Xi/chgdctl.c
    	Xi/chgfctl.c
    	Xi/xiallowev.c
    	Xi/xichangecursor.c
    	Xi/xichangehierarchy.c
    	Xi/xigetclientpointer.c
    	Xi/xigrabdev.c
    	Xi/xipassivegrab.c
    	Xi/xiproperty.c
    	Xi/xiquerydevice.c
    	Xi/xiquerypointer.c
    	Xi/xiselectev.c
    	Xi/xisetclientpointer.c
    	Xi/xisetdevfocus.c
    	Xi/xiwarppointer.c
    
    [RHEL5: Xi/xi* files are XI2 ]
    fde1375e
Name
Last commit
Last update
..
config Loading commit data...
extras Loading commit data...
include Loading commit data...
lib Loading commit data...
programs Loading commit data...
BUILD Loading commit data...
CHANGELOG Loading commit data...
COPYING Loading commit data...
ChangeLog.X.org Loading commit data...
Imakefile Loading commit data...
LABEL Loading commit data...
LICENSE Loading commit data...
Makefile Loading commit data...
README Loading commit data...
README.crypto Loading commit data...
RELNOTES Loading commit data...
registry Loading commit data...
xf86Date.h Loading commit data...