diff options
| author | Reinhard Tartler <siretart@tauware.de> | 2011-10-10 17:58:55 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-10-10 17:58:55 +0200 |
| commit | c4e7705d299fcfc058baaa0867e1a1e29d626c6f (patch) | |
| tree | 5f2997df7336d13a9b5fa5648a1253801dad4b8e /nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c | |
| parent | c9983230f1f37db868f628856122739566a9286d (diff) | |
| download | nx-libs-c4e7705d299fcfc058baaa0867e1a1e29d626c6f.tar.gz nx-libs-c4e7705d299fcfc058baaa0867e1a1e29d626c6f.tar.bz2 nx-libs-c4e7705d299fcfc058baaa0867e1a1e29d626c6f.zip | |
Imported nxagent-3.2.0-7.tar.gznxagent/3.2.0-7
Summary: Imported nxagent-3.2.0-7.tar.gz
Keywords:
Imported nxagent-3.2.0-7.tar.gz
into Git repository
Diffstat (limited to 'nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c')
| -rw-r--r-- | nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c index e3e4f4b83..a6d638ea7 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c @@ -967,8 +967,17 @@ ProcShmPutImage(client) return BadValue; } - VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, - client); + /* + * There's a potential integer overflow in this check: + * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, + * client); + * the version below ought to avoid it + */ + if (stuff->totalHeight != 0 && + length > (shmdesc->size - stuff->offset)/stuff->totalHeight) { + client->errorValue = stuff->totalWidth; + return BadValue; + } if (stuff->srcX > stuff->totalWidth) { client->errorValue = stuff->srcX; |