diff options
| author | Adam Jackson <ajax@redhat.com> | 2014-11-10 12:13:47 -0500 |
|---|---|---|
| committer | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> | 2015-02-14 16:14:32 +0100 |
| commit | 8931066077a04999d973932e04da577bd6906c82 (patch) | |
| tree | 1e6c672df74f3a65848772b8365b2cdd26847fc3 /nx-X11/programs/Xserver/GL/glx/singlepix.c | |
| parent | ad29acd7697e18333e164b1746f61c5a9e29a436 (diff) | |
| download | nx-libs-8931066077a04999d973932e04da577bd6906c82.tar.gz nx-libs-8931066077a04999d973932e04da577bd6906c82.tar.bz2 nx-libs-8931066077a04999d973932e04da577bd6906c82.zip | |
glx: Length checking for non-generated single requests (v2) [CVE-2014-8098 7/8]
v2:
Fix single versus vendor-private length checking for ARB_imaging subset
extensions. (Julien Cristau)
v3:
Fix single versus vendor-private length checking for ARB_imaging subset
extensions. (Julien Cristau)
v4: backport to nx-libs 3.6.x (Mike DePaulo)
Reviewed-by: Michal Srb <msrb@suse.com>
Reviewed-by: Andy Ritger <aritger@nvidia.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Fedora X Ninjas <x@fedoraproject.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
fix safe_Add
Diffstat (limited to 'nx-X11/programs/Xserver/GL/glx/singlepix.c')
| -rw-r--r-- | nx-X11/programs/Xserver/GL/glx/singlepix.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/nx-X11/programs/Xserver/GL/glx/singlepix.c b/nx-X11/programs/Xserver/GL/glx/singlepix.c index be804d82e..a156db5d3 100644 --- a/nx-X11/programs/Xserver/GL/glx/singlepix.c +++ b/nx-X11/programs/Xserver/GL/glx/singlepix.c @@ -57,6 +57,8 @@ int __glXDisp_ReadPixels(__GLXclientState *cl, GLbyte *pc) int error; char *answer, answerBuffer[200]; + REQUEST_FIXED_SIZE(xGLXSingleReq, 28); + cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { return error; @@ -108,6 +110,7 @@ int __glXDisp_GetTexImage(__GLXclientState *cl, GLbyte *pc) char *answer, answerBuffer[200]; GLint width=0, height=0, depth=1; + REQUEST_FIXED_SIZE(xGLXSingleReq, 20); cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { return error; @@ -204,6 +207,7 @@ int __glXDisp_GetSeparableFilter(__GLXclientState *cl, GLbyte *pc) char *answer, answerBuffer[200]; GLint width=0, height=0; + REQUEST_FIXED_SIZE(xGLXSingleReq, 16); cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { return error; @@ -227,13 +231,11 @@ int __glXDisp_GetSeparableFilter(__GLXclientState *cl, GLbyte *pc) compsize = __glGetTexImage_size(target,1,format,type,width,1,1); compsize2 = __glGetTexImage_size(target,1,format,type,height,1,1); - if (compsize < 0) return BadLength; - if (compsize2 < 0) compsize2 = 0; - compsize = __GLX_PAD(compsize); - compsize2 = __GLX_PAD(compsize2); + if ((compsize = safe_pad(compsize)) < 0) return BadLength; + if ((compsize2 = safe_pad(compsize2)) < 0) return BadLength; glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); - __GLX_GET_ANSWER_BUFFER(answer,cl,compsize + compsize2,1); + __GLX_GET_ANSWER_BUFFER(answer,cl,safe_add(compsize, compsize2),1); __glXClearErrorOccured(); glGetSeparableFilter( *(GLenum *)(pc + 0), @@ -269,6 +271,7 @@ int __glXDisp_GetConvolutionFilter(__GLXclientState *cl, GLbyte *pc) char *answer, answerBuffer[200]; GLint width=0, height=0; + REQUEST_FIXED_SIZE(xGLXSingleReq, 16); cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { return error; @@ -328,6 +331,8 @@ int __glXDisp_GetHistogram(__GLXclientState *cl, GLbyte *pc) char *answer, answerBuffer[200]; GLint width=0; + REQUEST_FIXED_SIZE(xGLXSingleReq, 16); + cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { return error; @@ -376,6 +381,8 @@ int __glXDisp_GetMinmax(__GLXclientState *cl, GLbyte *pc) int error; char *answer, answerBuffer[200]; + REQUEST_FIXED_SIZE(xGLXSingleReq, 16); + cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { return error; @@ -419,6 +426,8 @@ int __glXDisp_GetColorTable(__GLXclientState *cl, GLbyte *pc) char *answer, answerBuffer[200]; GLint width=0; + REQUEST_FIXED_SIZE(xGLXSingleReq, 16); + cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { return error; |