repositories / deb_xorg-server.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Imported Debian patch 2:1.15.1-0ubuntu2.6
[deb_xorg-server.git] / debian / patches / CVE-2014-8xxx / 0010-Xv-unvalidated-lengths-in-XVideo-extension-swapped-p.patch
CommitLineData
7217e0ca
ML		 1From 362ea7ec75543b694ebc8ab7268a2402e80a10bd Mon Sep 17 00:00:00 2001
2From: Alan Coopersmith <alan.coopersmith@oracle.com>
3Date: Sun, 26 Jan 2014 19:23:17 -0800
4Subject: [PATCH 10/33] Xv: unvalidated lengths in XVideo extension swapped
5 procs [CVE-2014-8099]
6
7Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
8Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
9---
10 Xext/xvdisp.c | 20 ++++++++++++++++++++
11 1 file changed, 20 insertions(+)
12
13Index: xorg-server-1.16.0/Xext/xvdisp.c
14===================================================================
15--- xorg-server-1.16.0.orig/Xext/xvdisp.c 2014-12-04 11:15:10.726714736 -0500
16+++ xorg-server-1.16.0/Xext/xvdisp.c 2014-12-04 11:15:10.722714693 -0500
17@@ -1207,6 +1207,7 @@
18 SProcXvQueryExtension(ClientPtr client)
19 {
20 REQUEST(xvQueryExtensionReq);
21+ REQUEST_SIZE_MATCH(xvQueryExtensionReq);
22 swaps(&stuff->length);
23 return XvProcVector[xv_QueryExtension] (client);
24 }
25@@ -1215,6 +1216,7 @@
26 SProcXvQueryAdaptors(ClientPtr client)
27 {
28 REQUEST(xvQueryAdaptorsReq);
29+ REQUEST_SIZE_MATCH(xvQueryAdaptorsReq);
30 swaps(&stuff->length);
31 swapl(&stuff->window);
32 return XvProcVector[xv_QueryAdaptors] (client);
33@@ -1224,6 +1226,7 @@
34 SProcXvQueryEncodings(ClientPtr client)
35 {
36 REQUEST(xvQueryEncodingsReq);
37+ REQUEST_SIZE_MATCH(xvQueryEncodingsReq);
38 swaps(&stuff->length);
39 swapl(&stuff->port);
40 return XvProcVector[xv_QueryEncodings] (client);
41@@ -1233,6 +1236,7 @@
42 SProcXvGrabPort(ClientPtr client)
43 {
44 REQUEST(xvGrabPortReq);
45+ REQUEST_SIZE_MATCH(xvGrabPortReq);
46 swaps(&stuff->length);
47 swapl(&stuff->port);
48 swapl(&stuff->time);
49@@ -1243,6 +1247,7 @@
50 SProcXvUngrabPort(ClientPtr client)
51 {
52 REQUEST(xvUngrabPortReq);
53+ REQUEST_SIZE_MATCH(xvUngrabPortReq);
54 swaps(&stuff->length);
55 swapl(&stuff->port);
56 swapl(&stuff->time);
57@@ -1253,6 +1258,7 @@
58 SProcXvPutVideo(ClientPtr client)
59 {
60 REQUEST(xvPutVideoReq);
61+ REQUEST_SIZE_MATCH(xvPutVideoReq);
62 swaps(&stuff->length);
63 swapl(&stuff->port);
64 swapl(&stuff->drawable);
65@@ -1272,6 +1278,7 @@
66 SProcXvPutStill(ClientPtr client)
67 {
68 REQUEST(xvPutStillReq);
69+ REQUEST_SIZE_MATCH(xvPutStillReq);
70 swaps(&stuff->length);
71 swapl(&stuff->port);
72 swapl(&stuff->drawable);
73@@ -1291,6 +1298,7 @@
74 SProcXvGetVideo(ClientPtr client)
75 {
76 REQUEST(xvGetVideoReq);
77+ REQUEST_SIZE_MATCH(xvGetVideoReq);
78 swaps(&stuff->length);
79 swapl(&stuff->port);
80 swapl(&stuff->drawable);
81@@ -1310,6 +1318,7 @@
82 SProcXvGetStill(ClientPtr client)
83 {
84 REQUEST(xvGetStillReq);
85+ REQUEST_SIZE_MATCH(xvGetStillReq);
86 swaps(&stuff->length);
87 swapl(&stuff->port);
88 swapl(&stuff->drawable);
89@@ -1329,6 +1338,7 @@
90 SProcXvPutImage(ClientPtr client)
91 {
92 REQUEST(xvPutImageReq);
93+ REQUEST_AT_LEAST_SIZE(xvPutImageReq);
94 swaps(&stuff->length);
95 swapl(&stuff->port);
96 swapl(&stuff->drawable);
97@@ -1352,6 +1362,7 @@
98 SProcXvShmPutImage(ClientPtr client)
99 {
100 REQUEST(xvShmPutImageReq);
101+ REQUEST_SIZE_MATCH(xvShmPutImageReq);
102 swaps(&stuff->length);
103 swapl(&stuff->port);
104 swapl(&stuff->drawable);
105@@ -1379,6 +1390,7 @@
106 SProcXvSelectVideoNotify(ClientPtr client)
107 {
108 REQUEST(xvSelectVideoNotifyReq);
109+ REQUEST_SIZE_MATCH(xvSelectVideoNotifyReq);
110 swaps(&stuff->length);
111 swapl(&stuff->drawable);
112 return XvProcVector[xv_SelectVideoNotify] (client);
113@@ -1388,6 +1400,7 @@
114 SProcXvSelectPortNotify(ClientPtr client)
115 {
116 REQUEST(xvSelectPortNotifyReq);
117+ REQUEST_SIZE_MATCH(xvSelectPortNotifyReq);
118 swaps(&stuff->length);
119 swapl(&stuff->port);
120 return XvProcVector[xv_SelectPortNotify] (client);
121@@ -1397,6 +1410,7 @@
122 SProcXvStopVideo(ClientPtr client)
123 {
124 REQUEST(xvStopVideoReq);
125+ REQUEST_SIZE_MATCH(xvStopVideoReq);
126 swaps(&stuff->length);
127 swapl(&stuff->port);
128 swapl(&stuff->drawable);
129@@ -1407,6 +1421,7 @@
130 SProcXvSetPortAttribute(ClientPtr client)
131 {
132 REQUEST(xvSetPortAttributeReq);
133+ REQUEST_SIZE_MATCH(xvSetPortAttributeReq);
134 swaps(&stuff->length);
135 swapl(&stuff->port);
136 swapl(&stuff->attribute);
137@@ -1418,6 +1433,7 @@
138 SProcXvGetPortAttribute(ClientPtr client)
139 {
140 REQUEST(xvGetPortAttributeReq);
141+ REQUEST_SIZE_MATCH(xvGetPortAttributeReq);
142 swaps(&stuff->length);
143 swapl(&stuff->port);
144 swapl(&stuff->attribute);
145@@ -1428,6 +1444,7 @@
146 SProcXvQueryBestSize(ClientPtr client)
147 {
148 REQUEST(xvQueryBestSizeReq);
149+ REQUEST_SIZE_MATCH(xvQueryBestSizeReq);
150 swaps(&stuff->length);
151 swapl(&stuff->port);
152 swaps(&stuff->vid_w);
153@@ -1441,6 +1458,7 @@
154 SProcXvQueryPortAttributes(ClientPtr client)
155 {
156 REQUEST(xvQueryPortAttributesReq);
157+ REQUEST_SIZE_MATCH(xvQueryPortAttributesReq);
158 swaps(&stuff->length);
159 swapl(&stuff->port);
160 return XvProcVector[xv_QueryPortAttributes] (client);
161@@ -1450,6 +1468,7 @@
162 SProcXvQueryImageAttributes(ClientPtr client)
163 {
164 REQUEST(xvQueryImageAttributesReq);
165+ REQUEST_SIZE_MATCH(xvQueryImageAttributesReq);
166 swaps(&stuff->length);
167 swapl(&stuff->port);
168 swapl(&stuff->id);
169@@ -1462,6 +1481,7 @@
170 SProcXvListImageFormats(ClientPtr client)
171 {
172 REQUEST(xvListImageFormatsReq);
173+ REQUEST_SIZE_MATCH(xvListImageFormatsReq);
174 swaps(&stuff->length);
175 swapl(&stuff->port);
176 return XvProcVector[xv_ListImageFormats] (client);
xorg-server Piment Noir Debian package repository