| 1 | From 53e2f52df33e5d45ce070ab2454c5a3d497cc8f6 Mon Sep 17 00:00:00 2001 |
| 2 | From: Adam Jackson <ajax@redhat.com> |
| 3 | Date: Mon, 10 Nov 2014 12:13:39 -0500 |
| 4 | Subject: [PATCH 23/33] glx: Fix image size computation for |
| 5 | EXT_texture_integer [CVE-2014-8098 1/8] |
| 6 | |
| 7 | Without this we'd reject the request with BadLength. Note that some old |
| 8 | versions of Mesa had a bug in the same place, and would _send_ zero |
| 9 | bytes of image data; these will now be rejected, correctly. |
| 10 | |
| 11 | Reviewed-by: Keith Packard <keithp@keithp.com> |
| 12 | Reviewed-by: Julien Cristau <jcristau@debian.org> |
| 13 | Reviewed-by: Michal Srb <msrb@suse.com> |
| 14 | Reviewed-by: Andy Ritger <aritger@nvidia.com> |
| 15 | Signed-off-by: Adam Jackson <ajax@redhat.com> |
| 16 | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> |
| 17 | --- |
| 18 | glx/rensize.c | 10 ++++++++++ |
| 19 | 1 file changed, 10 insertions(+) |
| 20 | |
| 21 | --- a/glx/rensize.c |
| 22 | +++ b/glx/rensize.c |
| 23 | @@ -224,6 +224,11 @@ __glXImageSize(GLenum format, GLenum typ |
| 24 | case GL_ALPHA: |
| 25 | case GL_LUMINANCE: |
| 26 | case GL_INTENSITY: |
| 27 | + case GL_RED_INTEGER_EXT: |
| 28 | + case GL_GREEN_INTEGER_EXT: |
| 29 | + case GL_BLUE_INTEGER_EXT: |
| 30 | + case GL_ALPHA_INTEGER_EXT: |
| 31 | + case GL_LUMINANCE_INTEGER_EXT: |
| 32 | elementsPerGroup = 1; |
| 33 | break; |
| 34 | case GL_422_EXT: |
| 35 | @@ -234,14 +239,19 @@ __glXImageSize(GLenum format, GLenum typ |
| 36 | case GL_DEPTH_STENCIL_MESA: |
| 37 | case GL_YCBCR_MESA: |
| 38 | case GL_LUMINANCE_ALPHA: |
| 39 | + case GL_LUMINANCE_ALPHA_INTEGER_EXT: |
| 40 | elementsPerGroup = 2; |
| 41 | break; |
| 42 | case GL_RGB: |
| 43 | case GL_BGR: |
| 44 | + case GL_RGB_INTEGER_EXT: |
| 45 | + case GL_BGR_INTEGER_EXT: |
| 46 | elementsPerGroup = 3; |
| 47 | break; |
| 48 | case GL_RGBA: |
| 49 | case GL_BGRA: |
| 50 | + case GL_RGBA_INTEGER_EXT: |
| 51 | + case GL_BGRA_INTEGER_EXT: |
| 52 | case GL_ABGR_EXT: |
| 53 | elementsPerGroup = 4; |
| 54 | break; |