diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-03-02 11:01:04 -0800 |
|---|---|---|
| committer | Ulrich Sibiller <uli42@gmx.de> | 2016-10-12 09:34:39 +0200 |
| commit | e6d8856ef465f9ab973026236df15d975e9cb069 (patch) | |
| tree | 7e7ac8c6a64e3b7f19dd6ea59d5fca631608b5db | |
| parent | e27df80700727725aea6c03986fa10e4ed0c6d65 (diff) | |
| download | nx-libs-e6d8856ef465f9ab973026236df15d975e9cb069.tar.gz nx-libs-e6d8856ef465f9ab973026236df15d975e9cb069.tar.bz2 nx-libs-e6d8856ef465f9ab973026236df15d975e9cb069.zip | |
unvalidated index in _XkbReadVirtualModMap() [CVE-2013-1997 10/15]
If the X server returns modifier map indexes outside the range of the number
of keys it told us to allocate, out of bounds memory writes could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
| -rw-r--r-- | nx-X11/lib/X11/XKBGetMap.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/nx-X11/lib/X11/XKBGetMap.c b/nx-X11/lib/X11/XKBGetMap.c index 5705f2649..ea2e6b512 100644 --- a/nx-X11/lib/X11/XKBGetMap.c +++ b/nx-X11/lib/X11/XKBGetMap.c @@ -426,6 +426,9 @@ xkbVModMapWireDesc * wire; XkbServerMapPtr srv; if ( rep->totalVModMapKeys>0 ) { + if (((int) rep->firstVModMapKey + rep->nVModMapKeys) + > xkb->max_key_code) + return BadLength; if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&& (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) { return BadAlloc; |