debian/patches/CVE-2014-8xxx/0010-Xv-unvalidated-lengths-in-XVideo-extension-swapped-p.patch

   1 From 362ea7ec75543b694ebc8ab7268a2402e80a10bd Mon Sep 17 00:00:00 2001
   2 From: Alan Coopersmith <alan.coopersmith@oracle.com>
   3 Date: Sun, 26 Jan 2014 19:23:17 -0800
   4 Subject: [PATCH 10/33] Xv: unvalidated lengths in XVideo extension swapped
   5  procs [CVE-2014-8099]
   6
   7 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
   8 Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
   9 ---
  10  Xext/xvdisp.c |   20 ++++++++++++++++++++
  11  1 file changed, 20 insertions(+)
  12
  13 --- a/Xext/xvdisp.c
  14 +++ b/Xext/xvdisp.c
  15 @@ -1207,6 +1207,7 @@ static int
  16  SProcXvQueryExtension(ClientPtr client)
  17  {
  18      REQUEST(xvQueryExtensionReq);
  19 +    REQUEST_SIZE_MATCH(xvQueryExtensionReq);
  20      swaps(&stuff->length);
  21      return XvProcVector[xv_QueryExtension] (client);
  22  }
  23 @@ -1215,6 +1216,7 @@ static int
  24  SProcXvQueryAdaptors(ClientPtr client)
  25  {
  26      REQUEST(xvQueryAdaptorsReq);
  27 +    REQUEST_SIZE_MATCH(xvQueryAdaptorsReq);
  28      swaps(&stuff->length);
  29      swapl(&stuff->window);
  30      return XvProcVector[xv_QueryAdaptors] (client);
  31 @@ -1224,6 +1226,7 @@ static int
  32  SProcXvQueryEncodings(ClientPtr client)
  33  {
  34      REQUEST(xvQueryEncodingsReq);
  35 +    REQUEST_SIZE_MATCH(xvQueryEncodingsReq);
  36      swaps(&stuff->length);
  37      swapl(&stuff->port);
  38      return XvProcVector[xv_QueryEncodings] (client);
  39 @@ -1233,6 +1236,7 @@ static int
  40  SProcXvGrabPort(ClientPtr client)
  41  {
  42      REQUEST(xvGrabPortReq);
  43 +    REQUEST_SIZE_MATCH(xvGrabPortReq);
  44      swaps(&stuff->length);
  45      swapl(&stuff->port);
  46      swapl(&stuff->time);
  47 @@ -1243,6 +1247,7 @@ static int
  48  SProcXvUngrabPort(ClientPtr client)
  49  {
  50      REQUEST(xvUngrabPortReq);
  51 +    REQUEST_SIZE_MATCH(xvUngrabPortReq);
  52      swaps(&stuff->length);
  53      swapl(&stuff->port);
  54      swapl(&stuff->time);
  55 @@ -1253,6 +1258,7 @@ static int
  56  SProcXvPutVideo(ClientPtr client)
  57  {
  58      REQUEST(xvPutVideoReq);
  59 +    REQUEST_SIZE_MATCH(xvPutVideoReq);
  60      swaps(&stuff->length);
  61      swapl(&stuff->port);
  62      swapl(&stuff->drawable);
  63 @@ -1272,6 +1278,7 @@ static int
  64  SProcXvPutStill(ClientPtr client)
  65  {
  66      REQUEST(xvPutStillReq);
  67 +    REQUEST_SIZE_MATCH(xvPutStillReq);
  68      swaps(&stuff->length);
  69      swapl(&stuff->port);
  70      swapl(&stuff->drawable);
  71 @@ -1291,6 +1298,7 @@ static int
  72  SProcXvGetVideo(ClientPtr client)
  73  {
  74      REQUEST(xvGetVideoReq);
  75 +    REQUEST_SIZE_MATCH(xvGetVideoReq);
  76      swaps(&stuff->length);
  77      swapl(&stuff->port);
  78      swapl(&stuff->drawable);
  79 @@ -1310,6 +1318,7 @@ static int
  80  SProcXvGetStill(ClientPtr client)
  81  {
  82      REQUEST(xvGetStillReq);
  83 +    REQUEST_SIZE_MATCH(xvGetStillReq);
  84      swaps(&stuff->length);
  85      swapl(&stuff->port);
  86      swapl(&stuff->drawable);
  87 @@ -1329,6 +1338,7 @@ static int
  88  SProcXvPutImage(ClientPtr client)
  89  {
  90      REQUEST(xvPutImageReq);
  91 +    REQUEST_AT_LEAST_SIZE(xvPutImageReq);
  92      swaps(&stuff->length);
  93      swapl(&stuff->port);
  94      swapl(&stuff->drawable);
  95 @@ -1352,6 +1362,7 @@ static int
  96  SProcXvShmPutImage(ClientPtr client)
  97  {
  98      REQUEST(xvShmPutImageReq);
  99 +    REQUEST_SIZE_MATCH(xvShmPutImageReq);
 100      swaps(&stuff->length);
 101      swapl(&stuff->port);
 102      swapl(&stuff->drawable);
 103 @@ -1379,6 +1390,7 @@ static int
 104  SProcXvSelectVideoNotify(ClientPtr client)
 105  {
 106      REQUEST(xvSelectVideoNotifyReq);
 107 +    REQUEST_SIZE_MATCH(xvSelectVideoNotifyReq);
 108      swaps(&stuff->length);
 109      swapl(&stuff->drawable);
 110      return XvProcVector[xv_SelectVideoNotify] (client);
 111 @@ -1388,6 +1400,7 @@ static int
 112  SProcXvSelectPortNotify(ClientPtr client)
 113  {
 114      REQUEST(xvSelectPortNotifyReq);
 115 +    REQUEST_SIZE_MATCH(xvSelectPortNotifyReq);
 116      swaps(&stuff->length);
 117      swapl(&stuff->port);
 118      return XvProcVector[xv_SelectPortNotify] (client);
 119 @@ -1397,6 +1410,7 @@ static int
 120  SProcXvStopVideo(ClientPtr client)
 121  {
 122      REQUEST(xvStopVideoReq);
 123 +    REQUEST_SIZE_MATCH(xvStopVideoReq);
 124      swaps(&stuff->length);
 125      swapl(&stuff->port);
 126      swapl(&stuff->drawable);
 127 @@ -1407,6 +1421,7 @@ static int
 128  SProcXvSetPortAttribute(ClientPtr client)
 129  {
 130      REQUEST(xvSetPortAttributeReq);
 131 +    REQUEST_SIZE_MATCH(xvSetPortAttributeReq);
 132      swaps(&stuff->length);
 133      swapl(&stuff->port);
 134      swapl(&stuff->attribute);
 135 @@ -1418,6 +1433,7 @@ static int
 136  SProcXvGetPortAttribute(ClientPtr client)
 137  {
 138      REQUEST(xvGetPortAttributeReq);
 139 +    REQUEST_SIZE_MATCH(xvGetPortAttributeReq);
 140      swaps(&stuff->length);
 141      swapl(&stuff->port);
 142      swapl(&stuff->attribute);
 143 @@ -1428,6 +1444,7 @@ static int
 144  SProcXvQueryBestSize(ClientPtr client)
 145  {
 146      REQUEST(xvQueryBestSizeReq);
 147 +    REQUEST_SIZE_MATCH(xvQueryBestSizeReq);
 148      swaps(&stuff->length);
 149      swapl(&stuff->port);
 150      swaps(&stuff->vid_w);
 151 @@ -1441,6 +1458,7 @@ static int
 152  SProcXvQueryPortAttributes(ClientPtr client)
 153  {
 154      REQUEST(xvQueryPortAttributesReq);
 155 +    REQUEST_SIZE_MATCH(xvQueryPortAttributesReq);
 156      swaps(&stuff->length);
 157      swapl(&stuff->port);
 158      return XvProcVector[xv_QueryPortAttributes] (client);
 159 @@ -1450,6 +1468,7 @@ static int
 160  SProcXvQueryImageAttributes(ClientPtr client)
 161  {
 162      REQUEST(xvQueryImageAttributesReq);
 163 +    REQUEST_SIZE_MATCH(xvQueryImageAttributesReq);
 164      swaps(&stuff->length);
 165      swapl(&stuff->port);
 166      swapl(&stuff->id);
 167 @@ -1462,6 +1481,7 @@ static int
 168  SProcXvListImageFormats(ClientPtr client)
 169  {
 170      REQUEST(xvListImageFormatsReq);
 171 +    REQUEST_SIZE_MATCH(xvListImageFormatsReq);
 172      swaps(&stuff->length);
 173      swapl(&stuff->port);
 174      return XvProcVector[xv_ListImageFormats] (client);