Commit | Line | Data |
---|---|---|
7217e0ca ML |
1 | From 53e2f52df33e5d45ce070ab2454c5a3d497cc8f6 Mon Sep 17 00:00:00 2001 |
2 | From: Adam Jackson <ajax@redhat.com> | |
3 | Date: Mon, 10 Nov 2014 12:13:39 -0500 | |
4 | Subject: [PATCH 23/33] glx: Fix image size computation for | |
5 | EXT_texture_integer [CVE-2014-8098 1/8] | |
6 | ||
7 | Without this we'd reject the request with BadLength. Note that some old | |
8 | versions of Mesa had a bug in the same place, and would _send_ zero | |
9 | bytes of image data; these will now be rejected, correctly. | |
10 | ||
11 | Reviewed-by: Keith Packard <keithp@keithp.com> | |
12 | Reviewed-by: Julien Cristau <jcristau@debian.org> | |
13 | Reviewed-by: Michal Srb <msrb@suse.com> | |
14 | Reviewed-by: Andy Ritger <aritger@nvidia.com> | |
15 | Signed-off-by: Adam Jackson <ajax@redhat.com> | |
16 | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> | |
17 | --- | |
18 | glx/rensize.c | 10 ++++++++++ | |
19 | 1 file changed, 10 insertions(+) | |
20 | ||
7217e0ca ML |
21 | --- a/glx/rensize.c |
22 | +++ b/glx/rensize.c | |
4db25562 | 23 | @@ -224,6 +224,11 @@ __glXImageSize(GLenum format, GLenum typ |
7217e0ca ML |
24 | case GL_ALPHA: |
25 | case GL_LUMINANCE: | |
26 | case GL_INTENSITY: | |
27 | + case GL_RED_INTEGER_EXT: | |
28 | + case GL_GREEN_INTEGER_EXT: | |
29 | + case GL_BLUE_INTEGER_EXT: | |
30 | + case GL_ALPHA_INTEGER_EXT: | |
31 | + case GL_LUMINANCE_INTEGER_EXT: | |
32 | elementsPerGroup = 1; | |
33 | break; | |
34 | case GL_422_EXT: | |
4db25562 | 35 | @@ -234,14 +239,19 @@ __glXImageSize(GLenum format, GLenum typ |
7217e0ca ML |
36 | case GL_DEPTH_STENCIL_MESA: |
37 | case GL_YCBCR_MESA: | |
38 | case GL_LUMINANCE_ALPHA: | |
39 | + case GL_LUMINANCE_ALPHA_INTEGER_EXT: | |
40 | elementsPerGroup = 2; | |
41 | break; | |
42 | case GL_RGB: | |
43 | case GL_BGR: | |
44 | + case GL_RGB_INTEGER_EXT: | |
45 | + case GL_BGR_INTEGER_EXT: | |
46 | elementsPerGroup = 3; | |
47 | break; | |
48 | case GL_RGBA: | |
49 | case GL_BGRA: | |
50 | + case GL_RGBA_INTEGER_EXT: | |
51 | + case GL_BGRA_INTEGER_EXT: | |
52 | case GL_ABGR_EXT: | |
53 | elementsPerGroup = 4; | |
54 | break; |