diff options
| author | Keith Packard <keithp@keithp.com> | 2014-12-09 09:30:57 -0800 |
|---|---|---|
| committer | Ulrich Sibiller <u.sibiller@science-computing.de> | 2016-10-20 10:16:35 +0200 |
| commit | e3e4062c35a5a337ca2edfddb0bf68b8b192fefb (patch) | |
| tree | 30ecfea8fc2153e4dc39211f87fc7c7d4ca38d74 /nxcompext | |
| parent | 01eaab8314a7b4a0cc5d5a10d9a0e87fc1709d72 (diff) | |
| download | nx-libs-e3e4062c35a5a337ca2edfddb0bf68b8b192fefb.tar.gz nx-libs-e3e4062c35a5a337ca2edfddb0bf68b8b192fefb.tar.bz2 nx-libs-e3e4062c35a5a337ca2edfddb0bf68b8b192fefb.zip | |
dbe: Call to DDX SwapBuffers requires address of int, not unsigned int [CVE-2014-8097 pt. 2]
When the local types used to walk the DBE request were changed, this
changed the type of the parameter passed to the DDX SwapBuffers API,
but there wasn't a matching change in the API definition.
At this point, with the API frozen, I just stuck a new variable in
with the correct type. Because we've already bounds-checked nStuff to
be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will
fit in a signed int without overflow.
Signed-off-by: Keith Packard <keithp@keithp.com
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
Diffstat (limited to 'nxcompext')
0 files changed, 0 insertions, 0 deletions