1 From 45000a2286023e2307fda53e602ab24afd2193be Mon Sep 17 00:00:00 2001
2 From: Alan Coopersmith <alan.coopersmith@oracle.com>
3 Date: Sun, 26 Jan 2014 19:28:05 -0800
4 Subject: [PATCH 11/33] dri3: unvalidated lengths in DRI3 extension swapped
5 procs [CVE-2014-8103 1/2]
7 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
8 Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
10 dri3/dri3_request.c | 6 ++++++
11 1 file changed, 6 insertions(+)
13 Index: xorg-server-1.15.1/dri3/dri3_request.c
14 ===================================================================
15 --- xorg-server-1.15.1.orig/dri3/dri3_request.c 2014-12-04 11:53:23.380277861 -0500
16 +++ xorg-server-1.15.1/dri3/dri3_request.c 2014-12-04 11:53:23.376277836 -0500
18 sproc_dri3_query_version(ClientPtr client)
20 REQUEST(xDRI3QueryVersionReq);
21 + REQUEST_SIZE_MATCH(xDRI3QueryVersionReq);
23 swaps(&stuff->length);
24 swapl(&stuff->majorVersion);
26 sproc_dri3_open(ClientPtr client)
28 REQUEST(xDRI3OpenReq);
29 + REQUEST_SIZE_MATCH(xDRI3OpenReq);
31 swaps(&stuff->length);
32 swapl(&stuff->drawable);
34 sproc_dri3_pixmap_from_buffer(ClientPtr client)
36 REQUEST(xDRI3PixmapFromBufferReq);
37 + REQUEST_SIZE_MATCH(xDRI3PixmapFromBufferReq);
39 swaps(&stuff->length);
40 swapl(&stuff->pixmap);
42 sproc_dri3_buffer_from_pixmap(ClientPtr client)
44 REQUEST(xDRI3BufferFromPixmapReq);
45 + REQUEST_SIZE_MATCH(xDRI3BufferFromPixmapReq);
47 swaps(&stuff->length);
48 swapl(&stuff->pixmap);
50 sproc_dri3_fence_from_fd(ClientPtr client)
52 REQUEST(xDRI3FenceFromFDReq);
53 + REQUEST_SIZE_MATCH(xDRI3FenceFromFDReq);
55 swaps(&stuff->length);
56 swapl(&stuff->drawable);
58 sproc_dri3_fd_from_fence(ClientPtr client)
60 REQUEST(xDRI3FDFromFenceReq);
61 + REQUEST_SIZE_MATCH(xDRI3FDFromFenceReq);
63 swaps(&stuff->length);
64 swapl(&stuff->drawable);