repositories / deb_xorg-server.git / blame
| Commit | Line | Data |
|---|---|---|
| 7217e0ca ML |
1 | From 53e2f52df33e5d45ce070ab2454c5a3d497cc8f6 Mon Sep 17 00:00:00 2001 |
| 2 | From: Adam Jackson <ajax@redhat.com> | |
| 3 | Date: Mon, 10 Nov 2014 12:13:39 -0500 | |
| 4 | Subject: [PATCH 23/33] glx: Fix image size computation for | |
| 5 | EXT_texture_integer [CVE-2014-8098 1/8] | |
| 6 | ||
| 7 | Without this we'd reject the request with BadLength. Note that some old | |
| 8 | versions of Mesa had a bug in the same place, and would _send_ zero | |
| 9 | bytes of image data; these will now be rejected, correctly. | |
| 10 | ||
| 11 | Reviewed-by: Keith Packard <keithp@keithp.com> | |
| 12 | Reviewed-by: Julien Cristau <jcristau@debian.org> | |
| 13 | Reviewed-by: Michal Srb <msrb@suse.com> | |
| 14 | Reviewed-by: Andy Ritger <aritger@nvidia.com> | |
| 15 | Signed-off-by: Adam Jackson <ajax@redhat.com> | |
| 16 | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> | |
| 17 | --- | |
| 18 | glx/rensize.c | 10 ++++++++++ | |
| 19 | 1 file changed, 10 insertions(+) | |
| 20 | ||
| 21 | diff --git a/glx/rensize.c b/glx/rensize.c | |
| 22 | index ba22d10..9ff73c7 100644 | |
| 23 | --- a/glx/rensize.c | |
| 24 | +++ b/glx/rensize.c | |
| 25 | @@ -224,6 +224,11 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, | |
| 26 | case GL_ALPHA: | |
| 27 | case GL_LUMINANCE: | |
| 28 | case GL_INTENSITY: | |
| 29 | + case GL_RED_INTEGER_EXT: | |
| 30 | + case GL_GREEN_INTEGER_EXT: | |
| 31 | + case GL_BLUE_INTEGER_EXT: | |
| 32 | + case GL_ALPHA_INTEGER_EXT: | |
| 33 | + case GL_LUMINANCE_INTEGER_EXT: | |
| 34 | elementsPerGroup = 1; | |
| 35 | break; | |
| 36 | case GL_422_EXT: | |
| 37 | @@ -234,14 +239,19 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, | |
| 38 | case GL_DEPTH_STENCIL_MESA: | |
| 39 | case GL_YCBCR_MESA: | |
| 40 | case GL_LUMINANCE_ALPHA: | |
| 41 | + case GL_LUMINANCE_ALPHA_INTEGER_EXT: | |
| 42 | elementsPerGroup = 2; | |
| 43 | break; | |
| 44 | case GL_RGB: | |
| 45 | case GL_BGR: | |
| 46 | + case GL_RGB_INTEGER_EXT: | |
| 47 | + case GL_BGR_INTEGER_EXT: | |
| 48 | elementsPerGroup = 3; | |
| 49 | break; | |
| 50 | case GL_RGBA: | |
| 51 | case GL_BGRA: | |
| 52 | + case GL_RGBA_INTEGER_EXT: | |
| 53 | + case GL_BGRA_INTEGER_EXT: | |
| 54 | case GL_ABGR_EXT: | |
| 55 | elementsPerGroup = 4; | |
| 56 | break; | |
| 57 | -- | |
| 58 | 1.7.9.2 | |
| 59 |