From d2b96c5d59766f96181de95da1906fd6e32785ba Mon Sep 17 00:00:00 2001 From: Mike DePaulo Date: Sun, 8 Feb 2015 22:26:16 -0500 Subject: CVE-2014-0210: unvalidated length fields in fs_read_extent_info() from xorg/lib/libXfont commit a3f21421537620fc4e1f844a594a4bcd9f7e2bd8 Looping over the extents in the reply could go past the end of the reply buffer if the reply indicated more extents than could fit in the specified reply length. --- nx-X11/lib/font/fc/fserve.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'nx-X11/lib/font') diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c index 639964c55..79de4f352 100644 --- a/nx-X11/lib/font/fc/fserve.c +++ b/nx-X11/lib/font/fc/fserve.c @@ -1066,6 +1066,16 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) fprintf(stderr, "fsQueryXExtents16: numInfos (%d) >= %ld\n", numInfos, (INT_MAX / sizeof(CharInfoRec))); +#endif + pCI = NULL; + } + else if (numExtents > ((rep->length - LENGTHOF(fsQueryXExtents16Reply)) + / LENGTHOF(fsXCharInfo))) { +#ifdef DEBUG + fprintf(stderr, + "fsQueryXExtents16: numExtents (%d) > (%d - %d) / %d\n", + numExtents, rep->length, + LENGTHOF(fsQueryXExtents16Reply), LENGTHOF(fsXCharInfo)); #endif pCI = NULL; } -- cgit v1.2.3