| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The length checking code validates PutImage height and byte width by
making sure that byte-width >= INT32_MAX / height. If height is zero,
this generates a divide by zero exception. Allow zero height requests
explicitly, bypassing the INT32_MAX check.
Fix for regression introduced by fix for CVE-2014-8092.
v2: backports to nx-libs 3.6.x (Mike Gabriel)
v3: port to NXdispatch.c rather than dispatch.c (Mike DePaulo)
Signed-off-by: Keith Packard <keithp@keithp.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
ProcPutImage() calculates a length field from a width, left pad and depth
specified by the client (if the specified format is XYPixmap).
The calculations for the total amount of memory the server needs for the
pixmap can overflow a 32-bit number, causing out-of-bounds memory writes
on 32-bit systems (since the length is stored in a long int variable).
v2: backport to nx-libs 3.6.x (Mike DePaulo)
v3: port to NXdispatch.c rather than dispatch.c (Mike DePaulo)
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Conflicts:
dix/dispatch.c
|
| |
|
|
|
|
|
|
|
|
|
| |
NX agent contains/ed two build trees. An old one (probably pre-3.x.y)
and a "newer" one. The "newer" code tree used to become enabled by
setting NXUpgradeAgentServer in nx-X11/config/cf/host.def to YES.
As building the NXUpgradeAgentServer has been the default for
years now, we drop all code that does not get used at build time
for NXUpgradeAgentServer == YES (i.e., the code that belongs to the
pre-3.x.y phase of NX agent).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It is allowed to try and allocate a pixmap which is larger than
32767 in either dimension. However, all of the framebuffer code
is buggy and does not reliably draw to such big pixmaps, basically
because the Region data structure operates with signed shorts
for the rectangles in it.
Furthermore, several places in the X server computes the
size in bytes of the pixmap and tries to store it in an
integer. This integer can overflow and cause the allocated size
to be much smaller.
So, such big pixmaps are rejected here with a BadAlloc
Originally contributed by FreeNX Team
|
| |
|
|
| |
This reverts commit e77bf36d9afbc7e56522574b06217d57c11dd095.
|
| | |
|
| |
|
|
|
|
|
|
| |
Summary: Imported nxagent-3.5.0-2.tar.gz
Keywords:
Imported nxagent-3.5.0-2.tar.gz
into Git repository
|
| |
|
|
|
|
|
|
| |
Summary: Imported nxagent-3.4.0-5.tar.gz
Keywords:
Imported nxagent-3.4.0-5.tar.gz
into Git repository
|
| |
|
|
|
|
|
|
| |
Summary: Imported nxagent-3.4.0-3.tar.gz
Keywords:
Imported nxagent-3.4.0-3.tar.gz
into Git repository
|
| |
|
|
|
|
|
|
| |
Summary: Imported nxagent-3.4.0-16.tar.gz
Keywords:
Imported nxagent-3.4.0-16.tar.gz
into Git repository
|
| |
|
|
|
|
|
|
| |
Summary: Imported nxagent-3.4.0-11.tar.gz
Keywords:
Imported nxagent-3.4.0-11.tar.gz
into Git repository
|
|
|
Summary: Imported nxagent-3.1.0-2.tar.gz
Keywords:
Imported nxagent-3.1.0-2.tar.gz
into Git repository
|
