debian/patches/CVE-2014-8xxx/0018-Add-request-length-checking-test-cases-for-some-Xinp.patch

   1 From a8d2ec0a4c11fb5804c073a5b74ba342d59843a8 Mon Sep 17 00:00:00 2001
   2 From: Alan Coopersmith <alan.coopersmith@oracle.com>
   3 Date: Sun, 9 Feb 2014 21:28:05 -0800
   4 Subject: [PATCH 18/33] Add request length checking test cases for some Xinput
   5  2.x requests
   6
   7 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
   8 Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
   9 ---
  10  test/xi2/protocol-xigetclientpointer.c  |    5 +++++
  11  test/xi2/protocol-xipassivegrabdevice.c |    8 ++++++++
  12  test/xi2/protocol-xiquerypointer.c      |    4 ++++
  13  test/xi2/protocol-xiwarppointer.c       |    3 +++
  14  4 files changed, 20 insertions(+)
  15
  16 --- a/test/xi2/protocol-xigetclientpointer.c
  17 +++ b/test/xi2/protocol-xigetclientpointer.c
  18 @@ -124,6 +124,11 @@ test_XIGetClientPointer(void)
  19      request.win = INVALID_WINDOW_ID;
  20      request_XIGetClientPointer(&client_request, &request, BadWindow);
  21
  22 +    printf("Testing invalid length\n");
  23 +    client_request.req_len -= 4;
  24 +    request_XIGetClientPointer(&client_request, &request, BadLength);
  25 +    client_request.req_len += 4;
  26 +
  27      test_data.cp_is_set = FALSE;
  28
  29      printf("Testing window None, unset ClientPointer.\n");
  30 --- a/test/xi2/protocol-xipassivegrabdevice.c
  31 +++ b/test/xi2/protocol-xipassivegrabdevice.c
  32 @@ -139,6 +139,7 @@ request_XIPassiveGrabDevice(ClientPtr cl
  33      int modifiers;
  34      int mask_len;
  35
  36 +    client_request.req_len = req->length;
  37      rc = ProcXIPassiveGrabDevice(&client_request);
  38      assert(rc == error);
  39
  40 @@ -190,6 +191,13 @@ test_XIPassiveGrabDevice(void)
  41      request_XIPassiveGrabDevice(&client_request, request, BadDevice,
  42                                  request->deviceid);
  43
  44 +    printf("Testing invalid length\n");
  45 +    request->length -= 2;
  46 +    request_XIPassiveGrabDevice(&client_request, request, BadLength,
  47 +                                client_request.errorValue);
  48 +    /* re-init request since swapped length test leaves some values swapped */
  49 +    request_init(request, XIPassiveGrabDevice);
  50 +    request->grab_window = CLIENT_WINDOW_ID;
  51      request->deviceid = XIAllMasterDevices;
  52
  53      printf("Testing invalid grab types\n");
  54 --- a/test/xi2/protocol-xiquerypointer.c
  55 +++ b/test/xi2/protocol-xiquerypointer.c
  56 @@ -201,6 +201,10 @@ test_XIQueryPointer(void)
  57      test_data.dev = devices.mouse;
  58      request.deviceid = devices.mouse->id;
  59      request_XIQueryPointer(&client_request, &request, Success);
  60 +
  61 +    /* test REQUEST_SIZE_MATCH */
  62 +    client_request.req_len -= 4;
  63 +    request_XIQueryPointer(&client_request, &request, BadLength);
  64  }
  65
  66  int
  67 --- a/test/xi2/protocol-xiwarppointer.c
  68 +++ b/test/xi2/protocol-xiwarppointer.c
  69 @@ -198,6 +198,9 @@ test_XIWarpPointer(void)
  70      request_XIWarpPointer(&client_request, &request, Success);
  71
  72      /* FIXME: src_x/y checks */
  73 +
  74 +    client_request.req_len -= 2; /* invalid length */
  75 +    request_XIWarpPointer(&client_request, &request, BadLength);
  76  }
  77
  78  int