| 1 | From 45000a2286023e2307fda53e602ab24afd2193be Mon Sep 17 00:00:00 2001 |
| 2 | From: Alan Coopersmith <alan.coopersmith@oracle.com> |
| 3 | Date: Sun, 26 Jan 2014 19:28:05 -0800 |
| 4 | Subject: [PATCH 11/33] dri3: unvalidated lengths in DRI3 extension swapped |
| 5 | procs [CVE-2014-8103 1/2] |
| 6 | |
| 7 | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> |
| 8 | Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> |
| 9 | --- |
| 10 | dri3/dri3_request.c | 6 ++++++ |
| 11 | 1 file changed, 6 insertions(+) |
| 12 | |
| 13 | Index: xorg-server-1.15.1/dri3/dri3_request.c |
| 14 | =================================================================== |
| 15 | --- xorg-server-1.15.1.orig/dri3/dri3_request.c 2014-12-04 11:53:23.380277861 -0500 |
| 16 | +++ xorg-server-1.15.1/dri3/dri3_request.c 2014-12-04 11:53:23.376277836 -0500 |
| 17 | @@ -311,6 +311,7 @@ |
| 18 | sproc_dri3_query_version(ClientPtr client) |
| 19 | { |
| 20 | REQUEST(xDRI3QueryVersionReq); |
| 21 | + REQUEST_SIZE_MATCH(xDRI3QueryVersionReq); |
| 22 | |
| 23 | swaps(&stuff->length); |
| 24 | swapl(&stuff->majorVersion); |
| 25 | @@ -322,6 +323,7 @@ |
| 26 | sproc_dri3_open(ClientPtr client) |
| 27 | { |
| 28 | REQUEST(xDRI3OpenReq); |
| 29 | + REQUEST_SIZE_MATCH(xDRI3OpenReq); |
| 30 | |
| 31 | swaps(&stuff->length); |
| 32 | swapl(&stuff->drawable); |
| 33 | @@ -333,6 +335,7 @@ |
| 34 | sproc_dri3_pixmap_from_buffer(ClientPtr client) |
| 35 | { |
| 36 | REQUEST(xDRI3PixmapFromBufferReq); |
| 37 | + REQUEST_SIZE_MATCH(xDRI3PixmapFromBufferReq); |
| 38 | |
| 39 | swaps(&stuff->length); |
| 40 | swapl(&stuff->pixmap); |
| 41 | @@ -348,6 +351,7 @@ |
| 42 | sproc_dri3_buffer_from_pixmap(ClientPtr client) |
| 43 | { |
| 44 | REQUEST(xDRI3BufferFromPixmapReq); |
| 45 | + REQUEST_SIZE_MATCH(xDRI3BufferFromPixmapReq); |
| 46 | |
| 47 | swaps(&stuff->length); |
| 48 | swapl(&stuff->pixmap); |
| 49 | @@ -358,6 +362,7 @@ |
| 50 | sproc_dri3_fence_from_fd(ClientPtr client) |
| 51 | { |
| 52 | REQUEST(xDRI3FenceFromFDReq); |
| 53 | + REQUEST_SIZE_MATCH(xDRI3FenceFromFDReq); |
| 54 | |
| 55 | swaps(&stuff->length); |
| 56 | swapl(&stuff->drawable); |
| 57 | @@ -369,6 +374,7 @@ |
| 58 | sproc_dri3_fd_from_fence(ClientPtr client) |
| 59 | { |
| 60 | REQUEST(xDRI3FDFromFenceReq); |
| 61 | + REQUEST_SIZE_MATCH(xDRI3FDFromFenceReq); |
| 62 | |
| 63 | swaps(&stuff->length); |
| 64 | swapl(&stuff->drawable); |