Commit | Line | Data |
---|---|---|
7217e0ca ML |
1 | From 45000a2286023e2307fda53e602ab24afd2193be Mon Sep 17 00:00:00 2001 |
2 | From: Alan Coopersmith <alan.coopersmith@oracle.com> | |
3 | Date: Sun, 26 Jan 2014 19:28:05 -0800 | |
4 | Subject: [PATCH 11/33] dri3: unvalidated lengths in DRI3 extension swapped | |
5 | procs [CVE-2014-8103 1/2] | |
6 | ||
7 | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> | |
8 | Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> | |
9 | --- | |
10 | dri3/dri3_request.c | 6 ++++++ | |
11 | 1 file changed, 6 insertions(+) | |
12 | ||
4db25562 JB |
13 | --- a/dri3/dri3_request.c |
14 | +++ b/dri3/dri3_request.c | |
15 | @@ -311,6 +311,7 @@ static int | |
7217e0ca ML |
16 | sproc_dri3_query_version(ClientPtr client) |
17 | { | |
18 | REQUEST(xDRI3QueryVersionReq); | |
19 | + REQUEST_SIZE_MATCH(xDRI3QueryVersionReq); | |
20 | ||
21 | swaps(&stuff->length); | |
22 | swapl(&stuff->majorVersion); | |
4db25562 | 23 | @@ -322,6 +323,7 @@ static int |
7217e0ca ML |
24 | sproc_dri3_open(ClientPtr client) |
25 | { | |
26 | REQUEST(xDRI3OpenReq); | |
27 | + REQUEST_SIZE_MATCH(xDRI3OpenReq); | |
28 | ||
29 | swaps(&stuff->length); | |
30 | swapl(&stuff->drawable); | |
4db25562 | 31 | @@ -333,6 +335,7 @@ static int |
7217e0ca ML |
32 | sproc_dri3_pixmap_from_buffer(ClientPtr client) |
33 | { | |
34 | REQUEST(xDRI3PixmapFromBufferReq); | |
35 | + REQUEST_SIZE_MATCH(xDRI3PixmapFromBufferReq); | |
36 | ||
37 | swaps(&stuff->length); | |
38 | swapl(&stuff->pixmap); | |
4db25562 | 39 | @@ -348,6 +351,7 @@ static int |
7217e0ca ML |
40 | sproc_dri3_buffer_from_pixmap(ClientPtr client) |
41 | { | |
42 | REQUEST(xDRI3BufferFromPixmapReq); | |
43 | + REQUEST_SIZE_MATCH(xDRI3BufferFromPixmapReq); | |
44 | ||
45 | swaps(&stuff->length); | |
46 | swapl(&stuff->pixmap); | |
4db25562 | 47 | @@ -358,6 +362,7 @@ static int |
7217e0ca ML |
48 | sproc_dri3_fence_from_fd(ClientPtr client) |
49 | { | |
50 | REQUEST(xDRI3FenceFromFDReq); | |
51 | + REQUEST_SIZE_MATCH(xDRI3FenceFromFDReq); | |
52 | ||
53 | swaps(&stuff->length); | |
54 | swapl(&stuff->drawable); | |
4db25562 | 55 | @@ -369,6 +374,7 @@ static int |
7217e0ca ML |
56 | sproc_dri3_fd_from_fence(ClientPtr client) |
57 | { | |
58 | REQUEST(xDRI3FDFromFenceReq); | |
59 | + REQUEST_SIZE_MATCH(xDRI3FDFromFenceReq); | |
60 | ||
61 | swaps(&stuff->length); | |
62 | swapl(&stuff->drawable); |