debian/patches/CVE-2014-8xxx/0001-unchecked-malloc-may-allow-unauthed-client-to-crash-.patch

   1 From d2f5bd2c3e3cbe4778749d457550355d344ca62a Mon Sep 17 00:00:00 2001
   2 From: Alan Coopersmith <alan.coopersmith@oracle.com>
   3 Date: Fri, 17 Jan 2014 18:54:03 -0800
   4 Subject: [PATCH 01/33] unchecked malloc may allow unauthed client to crash
   5  Xserver [CVE-2014-8091]
   6
   7 authdes_ezdecode() calls malloc() using a length provided by the
   8 connection handshake sent by a newly connected client in order
   9 to authenticate to the server, so should be treated as untrusted.
  10
  11 It didn't check if malloc() failed before writing to the newly
  12 allocated buffer, so could lead to a server crash if the server
  13 fails to allocate memory (up to UINT16_MAX bytes, since the len
  14 field is a CARD16 in the X protocol).
  15
  16 Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
  17 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
  18 Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
  19 ---
  20  os/rpcauth.c |    4 ++++
  21  1 file changed, 4 insertions(+)
  22
  23 --- a/os/rpcauth.c
  24 +++ b/os/rpcauth.c
  25 @@ -66,6 +66,10 @@ authdes_ezdecode(const char *inmsg, int
  26      SVCXPRT xprt;
  27
  28      temp_inmsg = malloc(len);
  29 +    if (temp_inmsg == NULL) {
  30 +        why = AUTH_FAILED; /* generic error, since there is no AUTH_BADALLOC */
  31 +        return NULL;
  32 +    }
  33      memmove(temp_inmsg, inmsg, len);
  34
  35      memset((char *) &msg, 0, sizeof(msg));