From ed1e13a1f4e316bcf0dc0d4b2c16b1df3f075005 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Wed, 22 Jan 2014 22:37:15 -0800 Subject: dix: integer overflow in RegionSizeof() [CVE-2014-8092 3/4] RegionSizeof contains several integer overflows if a large length value is passed in. Once we fix it to return 0 on overflow, we also have to fix the callers to handle this error condition v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau. v3: backport to nx-libs 3.6.x (Mike DePaulo) Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer Reviewed-by: Julien Cristau Conflicts: dix/region.c include/regionstr.h --- nx-X11/programs/Xserver/include/regionstr.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'nx-X11/programs/Xserver/include/regionstr.h') diff --git a/nx-X11/programs/Xserver/include/regionstr.h b/nx-X11/programs/Xserver/include/regionstr.h index 000bf3f41..cf41170a6 100644 --- a/nx-X11/programs/Xserver/include/regionstr.h +++ b/nx-X11/programs/Xserver/include/regionstr.h @@ -53,6 +53,9 @@ SOFTWARE. typedef struct _Region RegionRec, *RegionPtr; +#include +#include + #include "miscstruct.h" /* Return values from RectIn() */ @@ -93,7 +96,7 @@ extern RegDataRec miBrokenData; #define REGION_BOX(reg,i) (®ION_BOXPTR(reg)[i]) #define REGION_TOP(reg) REGION_BOX(reg, (reg)->data->numRects) #define REGION_END(reg) REGION_BOX(reg, (reg)->data->numRects - 1) -#define REGION_SZOF(n) (sizeof(RegDataRec) + ((n) * sizeof(BoxRec))) +#define REGION_SZOF(n) (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec)) ? sizeof(RegDataRec) + ((n) * sizeof(BoxRec)) : 0) /* Keith recommends weaning the region code of pScreen argument */ #define REG_pScreen screenInfo.screens[0] @@ -257,9 +260,10 @@ extern RegDataRec miBrokenData; } \ else \ { \ + size_t rgnSize; \ (_pReg)->extents = miEmptyBox; \ - if (((_size) > 1) && ((_pReg)->data = \ - (RegDataPtr)xalloc(REGION_SZOF(_size)))) \ + if (((_size) > 1) && ((rgnSize = REGION_SZOF(_size)) > 0) && \ + ((_pReg)->data = (RegDataPtr)xalloc(rgnSize))) \ { \ (_pReg)->data->size = (_size); \ (_pReg)->data->numRects = 0; \ -- cgit v1.2.3