repositories / deb_xorg-server.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
ODROID-U3 xorg-server debian package fork :
[deb_xorg-server.git] / debian / patches / CVE-2014-8xxx / 0010-Xv-unvalidated-lengths-in-XVideo-extension-swapped-p.patch
... / ...
CommitLineData
1From 362ea7ec75543b694ebc8ab7268a2402e80a10bd Mon Sep 17 00:00:00 2001
2From: Alan Coopersmith <alan.coopersmith@oracle.com>
3Date: Sun, 26 Jan 2014 19:23:17 -0800
4Subject: [PATCH 10/33] Xv: unvalidated lengths in XVideo extension swapped
5 procs [CVE-2014-8099]
6
7Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
8Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
9---
10 Xext/xvdisp.c | 20 ++++++++++++++++++++
11 1 file changed, 20 insertions(+)
12
13--- a/Xext/xvdisp.c
14+++ b/Xext/xvdisp.c
15@@ -1207,6 +1207,7 @@ static int
16 SProcXvQueryExtension(ClientPtr client)
17 {
18 REQUEST(xvQueryExtensionReq);
19+ REQUEST_SIZE_MATCH(xvQueryExtensionReq);
20 swaps(&stuff->length);
21 return XvProcVector[xv_QueryExtension] (client);
22 }
23@@ -1215,6 +1216,7 @@ static int
24 SProcXvQueryAdaptors(ClientPtr client)
25 {
26 REQUEST(xvQueryAdaptorsReq);
27+ REQUEST_SIZE_MATCH(xvQueryAdaptorsReq);
28 swaps(&stuff->length);
29 swapl(&stuff->window);
30 return XvProcVector[xv_QueryAdaptors] (client);
31@@ -1224,6 +1226,7 @@ static int
32 SProcXvQueryEncodings(ClientPtr client)
33 {
34 REQUEST(xvQueryEncodingsReq);
35+ REQUEST_SIZE_MATCH(xvQueryEncodingsReq);
36 swaps(&stuff->length);
37 swapl(&stuff->port);
38 return XvProcVector[xv_QueryEncodings] (client);
39@@ -1233,6 +1236,7 @@ static int
40 SProcXvGrabPort(ClientPtr client)
41 {
42 REQUEST(xvGrabPortReq);
43+ REQUEST_SIZE_MATCH(xvGrabPortReq);
44 swaps(&stuff->length);
45 swapl(&stuff->port);
46 swapl(&stuff->time);
47@@ -1243,6 +1247,7 @@ static int
48 SProcXvUngrabPort(ClientPtr client)
49 {
50 REQUEST(xvUngrabPortReq);
51+ REQUEST_SIZE_MATCH(xvUngrabPortReq);
52 swaps(&stuff->length);
53 swapl(&stuff->port);
54 swapl(&stuff->time);
55@@ -1253,6 +1258,7 @@ static int
56 SProcXvPutVideo(ClientPtr client)
57 {
58 REQUEST(xvPutVideoReq);
59+ REQUEST_SIZE_MATCH(xvPutVideoReq);
60 swaps(&stuff->length);
61 swapl(&stuff->port);
62 swapl(&stuff->drawable);
63@@ -1272,6 +1278,7 @@ static int
64 SProcXvPutStill(ClientPtr client)
65 {
66 REQUEST(xvPutStillReq);
67+ REQUEST_SIZE_MATCH(xvPutStillReq);
68 swaps(&stuff->length);
69 swapl(&stuff->port);
70 swapl(&stuff->drawable);
71@@ -1291,6 +1298,7 @@ static int
72 SProcXvGetVideo(ClientPtr client)
73 {
74 REQUEST(xvGetVideoReq);
75+ REQUEST_SIZE_MATCH(xvGetVideoReq);
76 swaps(&stuff->length);
77 swapl(&stuff->port);
78 swapl(&stuff->drawable);
79@@ -1310,6 +1318,7 @@ static int
80 SProcXvGetStill(ClientPtr client)
81 {
82 REQUEST(xvGetStillReq);
83+ REQUEST_SIZE_MATCH(xvGetStillReq);
84 swaps(&stuff->length);
85 swapl(&stuff->port);
86 swapl(&stuff->drawable);
87@@ -1329,6 +1338,7 @@ static int
88 SProcXvPutImage(ClientPtr client)
89 {
90 REQUEST(xvPutImageReq);
91+ REQUEST_AT_LEAST_SIZE(xvPutImageReq);
92 swaps(&stuff->length);
93 swapl(&stuff->port);
94 swapl(&stuff->drawable);
95@@ -1352,6 +1362,7 @@ static int
96 SProcXvShmPutImage(ClientPtr client)
97 {
98 REQUEST(xvShmPutImageReq);
99+ REQUEST_SIZE_MATCH(xvShmPutImageReq);
100 swaps(&stuff->length);
101 swapl(&stuff->port);
102 swapl(&stuff->drawable);
103@@ -1379,6 +1390,7 @@ static int
104 SProcXvSelectVideoNotify(ClientPtr client)
105 {
106 REQUEST(xvSelectVideoNotifyReq);
107+ REQUEST_SIZE_MATCH(xvSelectVideoNotifyReq);
108 swaps(&stuff->length);
109 swapl(&stuff->drawable);
110 return XvProcVector[xv_SelectVideoNotify] (client);
111@@ -1388,6 +1400,7 @@ static int
112 SProcXvSelectPortNotify(ClientPtr client)
113 {
114 REQUEST(xvSelectPortNotifyReq);
115+ REQUEST_SIZE_MATCH(xvSelectPortNotifyReq);
116 swaps(&stuff->length);
117 swapl(&stuff->port);
118 return XvProcVector[xv_SelectPortNotify] (client);
119@@ -1397,6 +1410,7 @@ static int
120 SProcXvStopVideo(ClientPtr client)
121 {
122 REQUEST(xvStopVideoReq);
123+ REQUEST_SIZE_MATCH(xvStopVideoReq);
124 swaps(&stuff->length);
125 swapl(&stuff->port);
126 swapl(&stuff->drawable);
127@@ -1407,6 +1421,7 @@ static int
128 SProcXvSetPortAttribute(ClientPtr client)
129 {
130 REQUEST(xvSetPortAttributeReq);
131+ REQUEST_SIZE_MATCH(xvSetPortAttributeReq);
132 swaps(&stuff->length);
133 swapl(&stuff->port);
134 swapl(&stuff->attribute);
135@@ -1418,6 +1433,7 @@ static int
136 SProcXvGetPortAttribute(ClientPtr client)
137 {
138 REQUEST(xvGetPortAttributeReq);
139+ REQUEST_SIZE_MATCH(xvGetPortAttributeReq);
140 swaps(&stuff->length);
141 swapl(&stuff->port);
142 swapl(&stuff->attribute);
143@@ -1428,6 +1444,7 @@ static int
144 SProcXvQueryBestSize(ClientPtr client)
145 {
146 REQUEST(xvQueryBestSizeReq);
147+ REQUEST_SIZE_MATCH(xvQueryBestSizeReq);
148 swaps(&stuff->length);
149 swapl(&stuff->port);
150 swaps(&stuff->vid_w);
151@@ -1441,6 +1458,7 @@ static int
152 SProcXvQueryPortAttributes(ClientPtr client)
153 {
154 REQUEST(xvQueryPortAttributesReq);
155+ REQUEST_SIZE_MATCH(xvQueryPortAttributesReq);
156 swaps(&stuff->length);
157 swapl(&stuff->port);
158 return XvProcVector[xv_QueryPortAttributes] (client);
159@@ -1450,6 +1468,7 @@ static int
160 SProcXvQueryImageAttributes(ClientPtr client)
161 {
162 REQUEST(xvQueryImageAttributesReq);
163+ REQUEST_SIZE_MATCH(xvQueryImageAttributesReq);
164 swaps(&stuff->length);
165 swapl(&stuff->port);
166 swapl(&stuff->id);
167@@ -1462,6 +1481,7 @@ static int
168 SProcXvListImageFormats(ClientPtr client)
169 {
170 REQUEST(xvListImageFormatsReq);
171+ REQUEST_SIZE_MATCH(xvListImageFormatsReq);
172 swaps(&stuff->length);
173 swapl(&stuff->port);
174 return XvProcVector[xv_ListImageFormats] (client);
xorg-server Piment Noir Debian package repository