aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs
diff options
context:
space:
mode:
authorPeter Harris <pharris@opentext.com>2017-02-14 15:19:18 +0000
committerMike Gabriel <mike.gabriel@das-netzwerkteam.de>2017-03-20 10:50:57 +0100
commitcbc2d300b984d7ebc789deac0642104f223c2920 (patch)
tree3fdf213b27c9f6576d9225e3f8fb16e7a1b4388a /nx-X11/programs
parent65b6a62bc726b5e4f4833ed1e27733e22fabcfa8 (diff)
downloadnx-libs-cbc2d300b984d7ebc789deac0642104f223c2920.tar.gz
nx-libs-cbc2d300b984d7ebc789deac0642104f223c2920.tar.bz2
nx-libs-cbc2d300b984d7ebc789deac0642104f223c2920.zip
Fix overflow of ConnectionOutput->size and ->count
commit 4b0d0df34f10a88c10cb23dd50087b59f5c4fece Author: Peter Harris <pharris@opentext.com> Date: Mon Nov 17 14:31:24 2014 -0500 Fix overflow of ConnectionOutput->size and ->count When (long) is larger than (int), and when realloc succeeds with sizes larger than INT_MAX, ConnectionOutput->size and ConnectionOutput->count overflow and become negative. When ConnectionOutput->count is negative, InsertIOV does not actually insert an IOV, and FlushClient goes into an infinite loop of writev(fd, iov, 0) [an empty list]. Avoid this situation by killing the client when it has more than INT_MAX unread bytes of data. Signed-off-by: Peter Harris <pharris@opentext.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com> Backported-to-NX-by: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Diffstat (limited to 'nx-X11/programs')
-rw-r--r--nx-X11/programs/Xserver/os/io.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/nx-X11/programs/Xserver/os/io.c b/nx-X11/programs/Xserver/os/io.c
index f4da96518..4dc1e7a34 100644
--- a/nx-X11/programs/Xserver/os/io.c
+++ b/nx-X11/programs/Xserver/os/io.c
@@ -1087,10 +1087,11 @@ FlushClient(ClientPtr who, OsCommPtr oc, const void *__extraBuf, int extraCount)
if (notWritten > oco->size)
{
- unsigned char *obuf;
+ unsigned char *obuf = NULL;
- obuf = (unsigned char *)realloc(oco->buf,
- notWritten + BUFSIZE);
+ if (notWritten + BUFSIZE <= INT_MAX) {
+ obuf = realloc(oco->buf, notWritten + BUFSIZE);
+ }
if (!obuf)
{
_XSERVTransDisconnect(oc->trans_conn);