aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
diff options
context:
space:
mode:
authorReinhard Tartler <siretart@tauware.de>2011-10-10 17:58:31 +0200
committerReinhard Tartler <siretart@tauware.de>2011-10-10 17:58:31 +0200
commit1c25e92b9ea5811d8ab9c2bfdc0dcb2e4d21bd0a (patch)
tree56b1d4196538a8abb7747e8455b59aa778d6b948 /nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
parent266b5554943baffafbf1d574f567283cc9792278 (diff)
downloadnx-libs-1c25e92b9ea5811d8ab9c2bfdc0dcb2e4d21bd0a.tar.gz
nx-libs-1c25e92b9ea5811d8ab9c2bfdc0dcb2e4d21bd0a.tar.bz2
nx-libs-1c25e92b9ea5811d8ab9c2bfdc0dcb2e4d21bd0a.zip
Imported nxagent-3.2.0-10.tar.gznxagent/3.2.0-10
Summary: Imported nxagent-3.2.0-10.tar.gz Keywords: Imported nxagent-3.2.0-10.tar.gz into Git repository
Diffstat (limited to 'nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original')
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original13
1 files changed, 11 insertions, 2 deletions
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
index e2cf8cd24..f25bb9b5d 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
@@ -863,8 +863,17 @@ ProcShmPutImage(client)
return BadValue;
}
- VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
- client);
+ /*
+ * There's a potential integer overflow in this check:
+ * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
+ * client);
+ * the version below ought to avoid it
+ */
+ if (stuff->totalHeight != 0 &&
+ length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
+ client->errorValue = stuff->totalWidth;
+ return BadValue;
+ }
if (stuff->srcX > stuff->totalWidth)
{
client->errorValue = stuff->srcX;