aboutsummaryrefslogtreecommitdiff
path: root/nx-X11
diff options
context:
space:
mode:
authorAlan Coopersmith <alan.coopersmith@oracle.com>2013-03-01 22:49:01 -0800
committerUlrich Sibiller <uli42@gmx.de>2016-10-12 09:34:38 +0200
commit7d18bbe93809a209dcd3590c4f519f19251323d9 (patch)
tree5071171da34c7444246890ffa88b8686d2a0cfab /nx-X11
parent29779559c92c3058edc298ca0a6e59e1293262b6 (diff)
downloadnx-libs-7d18bbe93809a209dcd3590c4f519f19251323d9.tar.gz
nx-libs-7d18bbe93809a209dcd3590c4f519f19251323d9.tar.bz2
nx-libs-7d18bbe93809a209dcd3590c4f519f19251323d9.zip
integer overflow in XGetMotionEvents() [CVE-2013-1981 4/13]
If the reported number of motion events is too large, the calculations to allocate memory for them may overflow, leaving us writing beyond the bounds of the allocation. v2: Ensure nEvents is set to 0 when returning NULL events pointer Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Julien Cristau <jcristau@debian.org> Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
Diffstat (limited to 'nx-X11')
-rw-r--r--nx-X11/lib/X11/GetMoEv.c26
1 files changed, 11 insertions, 15 deletions
diff --git a/nx-X11/lib/X11/GetMoEv.c b/nx-X11/lib/X11/GetMoEv.c
index 3db176feb..ad9c77277 100644
--- a/nx-X11/lib/X11/GetMoEv.c
+++ b/nx-X11/lib/X11/GetMoEv.c
@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
#include <config.h>
#endif
#include "Xlibint.h"
+#include <limits.h>
XTimeCoord *XGetMotionEvents(
register Display *dpy,
@@ -39,7 +40,6 @@ XTimeCoord *XGetMotionEvents(
xGetMotionEventsReply rep;
register xGetMotionEventsReq *req;
XTimeCoord *tc = NULL;
- long nbytes;
LockDisplay(dpy);
GetReq(GetMotionEvents, req);
req->window = w;
@@ -52,26 +52,22 @@ XTimeCoord *XGetMotionEvents(
return (NULL);
}
- if (rep.nEvents) {
- if (! (tc = (XTimeCoord *)
- Xmalloc( (unsigned)
- (nbytes = (long) rep.nEvents * sizeof(XTimeCoord))))) {
- _XEatData (dpy, (unsigned long) nbytes);
- UnlockDisplay(dpy);
- SyncHandle();
- return (NULL);
- }
+ if (rep.nEvents && (rep.nEvents < (INT_MAX / sizeof(XTimeCoord))))
+ tc = Xmalloc(rep.nEvents * sizeof(XTimeCoord));
+ if (tc == NULL) {
+ /* server returned either no events or a bad event count */
+ *nEvents = 0;
+ _XEatDataWords (dpy, rep.length);
}
-
- *nEvents = rep.nEvents;
- nbytes = SIZEOF (xTimecoord);
+ else
{
register XTimeCoord *tcptr;
- register int i;
+ unsigned int i;
xTimecoord xtc;
+ *nEvents = (int) rep.nEvents;
for (i = rep.nEvents, tcptr = tc; i > 0; i--, tcptr++) {
- _XRead (dpy, (char *) &xtc, nbytes);
+ _XRead (dpy, (char *) &xtc, SIZEOF (xTimecoord));
tcptr->time = xtc.time;
tcptr->x = cvtINT16toShort (xtc.x);
tcptr->y = cvtINT16toShort (xtc.y);