CVE-2014-0209: integer overflow of realloc() size in lexAlias() from xorg/lib/libXfont commit 05c8020a49416dd8b7510cbba45ce4f3fc81a7dc

lexAlias() reads from a file in a loop. It does this by starting with a
64 byte buffer.  If that size limit is hit, it does a realloc of the
buffer size << 1, basically doubling the needed length every time the
length limit is hit.

Eventually, this will shift out to 0 (for a length of ~4gig), and that
length will be passed on to realloc().  A length of 0 (with a valid
pointer) causes realloc to free the buffer on most POSIX platforms,
but the caller will still have a pointer to it, leading to use after
free issues.

0 files changed, 0 insertions, 0 deletions