From e6fbdea84a23ab88ff1ec98ba179273cab09adfb Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 2 Mar 2013 09:18:26 -0800
Subject: unvalidated indexes in _XkbReadGetGeometryReply() [CVE-2013-1997
 4/15]

If the X server returns color indexes outside the range of the number of
colors it told us to allocate, out of bounds memory access could occur.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
---
 nx-X11/lib/X11/XKBGeom.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'nx-X11')

diff --git a/nx-X11/lib/X11/XKBGeom.c b/nx-X11/lib/X11/XKBGeom.c
index b145e7eda..1f9628bea 100644
--- a/nx-X11/lib/X11/XKBGeom.c
+++ b/nx-X11/lib/X11/XKBGeom.c
@@ -619,6 +619,9 @@ XkbGeometryPtr	geom;
 	    if (status==Success)
 		status= _XkbReadGeomKeyAliases(&buf,geom,rep);
 	    left= _XkbFreeReadBuffer(&buf);
+	    if ((rep->baseColorNdx > geom->num_colors) ||
+		(rep->labelColorNdx > geom->num_colors))
+		status = BadLength;
 	    if ((status!=Success) || left || buf.error) {
 		if (status==Success)
 		    status= BadLength;
-- 
cgit v1.2.3