repositories / deb_xorg-server.git / blame
| Commit | Line | Data |
|---|---|---|
| 7217e0ca ML |
1 | From 45000a2286023e2307fda53e602ab24afd2193be Mon Sep 17 00:00:00 2001 |
| 2 | From: Alan Coopersmith <alan.coopersmith@oracle.com> | |
| 3 | Date: Sun, 26 Jan 2014 19:28:05 -0800 | |
| 4 | Subject: [PATCH 11/33] dri3: unvalidated lengths in DRI3 extension swapped | |
| 5 | procs [CVE-2014-8103 1/2] | |
| 6 | ||
| 7 | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> | |
| 8 | Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> | |
| 9 | --- | |
| 10 | dri3/dri3_request.c | 6 ++++++ | |
| 11 | 1 file changed, 6 insertions(+) | |
| 12 | ||
| 13 | Index: xorg-server-1.15.1/dri3/dri3_request.c | |
| 14 | =================================================================== | |
| 15 | --- xorg-server-1.15.1.orig/dri3/dri3_request.c 2014-12-04 11:53:23.380277861 -0500 | |
| 16 | +++ xorg-server-1.15.1/dri3/dri3_request.c 2014-12-04 11:53:23.376277836 -0500 | |
| 17 | @@ -311,6 +311,7 @@ | |
| 18 | sproc_dri3_query_version(ClientPtr client) | |
| 19 | { | |
| 20 | REQUEST(xDRI3QueryVersionReq); | |
| 21 | + REQUEST_SIZE_MATCH(xDRI3QueryVersionReq); | |
| 22 | ||
| 23 | swaps(&stuff->length); | |
| 24 | swapl(&stuff->majorVersion); | |
| 25 | @@ -322,6 +323,7 @@ | |
| 26 | sproc_dri3_open(ClientPtr client) | |
| 27 | { | |
| 28 | REQUEST(xDRI3OpenReq); | |
| 29 | + REQUEST_SIZE_MATCH(xDRI3OpenReq); | |
| 30 | ||
| 31 | swaps(&stuff->length); | |
| 32 | swapl(&stuff->drawable); | |
| 33 | @@ -333,6 +335,7 @@ | |
| 34 | sproc_dri3_pixmap_from_buffer(ClientPtr client) | |
| 35 | { | |
| 36 | REQUEST(xDRI3PixmapFromBufferReq); | |
| 37 | + REQUEST_SIZE_MATCH(xDRI3PixmapFromBufferReq); | |
| 38 | ||
| 39 | swaps(&stuff->length); | |
| 40 | swapl(&stuff->pixmap); | |
| 41 | @@ -348,6 +351,7 @@ | |
| 42 | sproc_dri3_buffer_from_pixmap(ClientPtr client) | |
| 43 | { | |
| 44 | REQUEST(xDRI3BufferFromPixmapReq); | |
| 45 | + REQUEST_SIZE_MATCH(xDRI3BufferFromPixmapReq); | |
| 46 | ||
| 47 | swaps(&stuff->length); | |
| 48 | swapl(&stuff->pixmap); | |
| 49 | @@ -358,6 +362,7 @@ | |
| 50 | sproc_dri3_fence_from_fd(ClientPtr client) | |
| 51 | { | |
| 52 | REQUEST(xDRI3FenceFromFDReq); | |
| 53 | + REQUEST_SIZE_MATCH(xDRI3FenceFromFDReq); | |
| 54 | ||
| 55 | swaps(&stuff->length); | |
| 56 | swapl(&stuff->drawable); | |
| 57 | @@ -369,6 +374,7 @@ | |
| 58 | sproc_dri3_fd_from_fence(ClientPtr client) | |
| 59 | { | |
| 60 | REQUEST(xDRI3FDFromFenceReq); | |
| 61 | + REQUEST_SIZE_MATCH(xDRI3FDFromFenceReq); | |
| 62 | ||
| 63 | swaps(&stuff->length); | |
| 64 | swapl(&stuff->drawable); |