aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/lib/X11/XKBGetMap.c
diff options
context:
space:
mode:
authorAlan Coopersmith <alan.coopersmith@oracle.com>2013-03-02 11:01:04 -0800
committerUlrich Sibiller <uli42@gmx.de>2016-10-12 09:34:39 +0200
commite6d8856ef465f9ab973026236df15d975e9cb069 (patch)
tree7e7ac8c6a64e3b7f19dd6ea59d5fca631608b5db /nx-X11/lib/X11/XKBGetMap.c
parente27df80700727725aea6c03986fa10e4ed0c6d65 (diff)
downloadnx-libs-e6d8856ef465f9ab973026236df15d975e9cb069.tar.gz
nx-libs-e6d8856ef465f9ab973026236df15d975e9cb069.tar.bz2
nx-libs-e6d8856ef465f9ab973026236df15d975e9cb069.zip
unvalidated index in _XkbReadVirtualModMap() [CVE-2013-1997 10/15]
If the X server returns modifier map indexes outside the range of the number of keys it told us to allocate, out of bounds memory writes could occur. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr> Signed-off-by: Julien Cristau <jcristau@debian.org> Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
Diffstat (limited to 'nx-X11/lib/X11/XKBGetMap.c')
-rw-r--r--nx-X11/lib/X11/XKBGetMap.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/nx-X11/lib/X11/XKBGetMap.c b/nx-X11/lib/X11/XKBGetMap.c
index 5705f2649..ea2e6b512 100644
--- a/nx-X11/lib/X11/XKBGetMap.c
+++ b/nx-X11/lib/X11/XKBGetMap.c
@@ -426,6 +426,9 @@ xkbVModMapWireDesc * wire;
XkbServerMapPtr srv;
if ( rep->totalVModMapKeys>0 ) {
+ if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
+ > xkb->max_key_code)
+ return BadLength;
if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
(XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {
return BadAlloc;