debian/patches/CVE-2014-8xxx/0011-dri3-unvalidated-lengths-in-DRI3-extension-swapped-p.patch

   1 From 45000a2286023e2307fda53e602ab24afd2193be Mon Sep 17 00:00:00 2001
   2 From: Alan Coopersmith <alan.coopersmith@oracle.com>
   3 Date: Sun, 26 Jan 2014 19:28:05 -0800
   4 Subject: [PATCH 11/33] dri3: unvalidated lengths in DRI3 extension swapped
   5  procs [CVE-2014-8103 1/2]
   6
   7 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
   8 Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
   9 ---
  10  dri3/dri3_request.c |    6 ++++++
  11  1 file changed, 6 insertions(+)
  12
  13 --- a/dri3/dri3_request.c
  14 +++ b/dri3/dri3_request.c
  15 @@ -311,6 +311,7 @@ static int
  16  sproc_dri3_query_version(ClientPtr client)
  17  {
  18      REQUEST(xDRI3QueryVersionReq);
  19 +    REQUEST_SIZE_MATCH(xDRI3QueryVersionReq);
  20
  21      swaps(&stuff->length);
  22      swapl(&stuff->majorVersion);
  23 @@ -322,6 +323,7 @@ static int
  24  sproc_dri3_open(ClientPtr client)
  25  {
  26      REQUEST(xDRI3OpenReq);
  27 +    REQUEST_SIZE_MATCH(xDRI3OpenReq);
  28
  29      swaps(&stuff->length);
  30      swapl(&stuff->drawable);
  31 @@ -333,6 +335,7 @@ static int
  32  sproc_dri3_pixmap_from_buffer(ClientPtr client)
  33  {
  34      REQUEST(xDRI3PixmapFromBufferReq);
  35 +    REQUEST_SIZE_MATCH(xDRI3PixmapFromBufferReq);
  36
  37      swaps(&stuff->length);
  38      swapl(&stuff->pixmap);
  39 @@ -348,6 +351,7 @@ static int
  40  sproc_dri3_buffer_from_pixmap(ClientPtr client)
  41  {
  42      REQUEST(xDRI3BufferFromPixmapReq);
  43 +    REQUEST_SIZE_MATCH(xDRI3BufferFromPixmapReq);
  44
  45      swaps(&stuff->length);
  46      swapl(&stuff->pixmap);
  47 @@ -358,6 +362,7 @@ static int
  48  sproc_dri3_fence_from_fd(ClientPtr client)
  49  {
  50      REQUEST(xDRI3FenceFromFDReq);
  51 +    REQUEST_SIZE_MATCH(xDRI3FenceFromFDReq);
  52
  53      swaps(&stuff->length);
  54      swapl(&stuff->drawable);
  55 @@ -369,6 +374,7 @@ static int
  56  sproc_dri3_fd_from_fence(ClientPtr client)
  57  {
  58      REQUEST(xDRI3FDFromFenceReq);
  59 +    REQUEST_SIZE_MATCH(xDRI3FDFromFenceReq);
  60
  61      swaps(&stuff->length);
  62      swapl(&stuff->drawable);