debian/patches/CVE-2014-8xxx/0021-glx-Be-more-strict-about-rejecting-invalid-image-siz.patch

   1 From 74e31c4809dbfe437a3e2a53ee38658da1f3c8ed Mon Sep 17 00:00:00 2001
   2 From: Adam Jackson <ajax@redhat.com>
   3 Date: Mon, 10 Nov 2014 12:13:37 -0500
   4 Subject: [PATCH 21/33] glx: Be more strict about rejecting invalid image
   5  sizes [CVE-2014-8093 2/6]
   6
   7 Before this we'd just clamp the image size to 0, which was just
   8 hideously stupid; if the parameters were such that they'd overflow an
   9 integer, you'd allocate a small buffer, then pass huge values into (say)
  10 ReadPixels, and now you're scribbling over arbitrary server memory.
  11
  12 Reviewed-by: Keith Packard <keithp@keithp.com>
  13 Reviewed-by: Julien Cristau <jcristau@debian.org>
  14 Reviewed-by: Michal Srb <msrb@suse.com>
  15 Reviewed-by: Andy Ritger <aritger@nvidia.com>
  16 Signed-off-by: Adam Jackson <ajax@redhat.com>
  17 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
  18 ---
  19  glx/singlepix.c     |   16 ++++++++--------
  20  glx/singlepixswap.c |   16 ++++++++--------
  21  2 files changed, 16 insertions(+), 16 deletions(-)
  22
  23 --- a/glx/singlepix.c
  24 +++ b/glx/singlepix.c
  25 @@ -65,7 +65,7 @@ __glXDisp_ReadPixels(__GLXclientState *
  26      lsbFirst = *(GLboolean *) (pc + 25);
  27      compsize = __glReadPixels_size(format, type, width, height);
  28      if (compsize < 0)
  29 -        compsize = 0;
  30 +        return BadLength;
  31
  32      glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
  33      glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst);
  34 @@ -124,7 +124,7 @@ __glXDisp_GetTexImage(__GLXclientState *
  35      compsize =
  36          __glGetTexImage_size(target, level, format, type, width, height, depth);
  37      if (compsize < 0)
  38 -        compsize = 0;
  39 +        return BadLength;
  40
  41      glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
  42      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
  43 @@ -218,9 +218,9 @@ GetSeparableFilter(__GLXclientState * cl
  44      compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
  45
  46      if (compsize < 0)
  47 -        compsize = 0;
  48 +        return BadLength;
  49      if (compsize2 < 0)
  50 -        compsize2 = 0;
  51 +        return BadLength;
  52      compsize = __GLX_PAD(compsize);
  53      compsize2 = __GLX_PAD(compsize2);
  54
  55 @@ -296,7 +296,7 @@ GetConvolutionFilter(__GLXclientState *
  56       */
  57      compsize = __glGetTexImage_size(target, 1, format, type, width, height, 1);
  58      if (compsize < 0)
  59 -        compsize = 0;
  60 +        return BadLength;
  61
  62      glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
  63      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
  64 @@ -365,7 +365,7 @@ GetHistogram(__GLXclientState * cl, GLby
  65       */
  66      compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
  67      if (compsize < 0)
  68 -        compsize = 0;
  69 +        return BadLength;
  70
  71      glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
  72      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
  73 @@ -426,7 +426,7 @@ GetMinmax(__GLXclientState * cl, GLbyte
  74
  75      compsize = __glGetTexImage_size(target, 1, format, type, 2, 1, 1);
  76      if (compsize < 0)
  77 -        compsize = 0;
  78 +        return BadLength;
  79
  80      glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
  81      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
  82 @@ -491,7 +491,7 @@ GetColorTable(__GLXclientState * cl, GLb
  83       */
  84      compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
  85      if (compsize < 0)
  86 -        compsize = 0;
  87 +        return BadLength;
  88
  89      glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
  90      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
  91 --- a/glx/singlepixswap.c
  92 +++ b/glx/singlepixswap.c
  93 @@ -75,7 +75,7 @@ __glXDispSwap_ReadPixels(__GLXclientStat
  94      lsbFirst = *(GLboolean *) (pc + 25);
  95      compsize = __glReadPixels_size(format, type, width, height);
  96      if (compsize < 0)
  97 -        compsize = 0;
  98 +        return BadLength;
  99
 100      glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
 101      glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst);
 102 @@ -144,7 +144,7 @@ __glXDispSwap_GetTexImage(__GLXclientSta
 103      compsize =
 104          __glGetTexImage_size(target, level, format, type, width, height, depth);
 105      if (compsize < 0)
 106 -        compsize = 0;
 107 +        return BadLength;
 108
 109      glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
 110      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
 111 @@ -252,9 +252,9 @@ GetSeparableFilter(__GLXclientState * cl
 112      compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
 113
 114      if (compsize < 0)
 115 -        compsize = 0;
 116 +        return BadLength;
 117      if (compsize2 < 0)
 118 -        compsize2 = 0;
 119 +        return BadLength;
 120      compsize = __GLX_PAD(compsize);
 121      compsize2 = __GLX_PAD(compsize2);
 122
 123 @@ -338,7 +338,7 @@ GetConvolutionFilter(__GLXclientState *
 124       */
 125      compsize = __glGetTexImage_size(target, 1, format, type, width, height, 1);
 126      if (compsize < 0)
 127 -        compsize = 0;
 128 +        return BadLength;
 129
 130      glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
 131      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
 132 @@ -415,7 +415,7 @@ GetHistogram(__GLXclientState * cl, GLby
 133       */
 134      compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
 135      if (compsize < 0)
 136 -        compsize = 0;
 137 +        return BadLength;
 138
 139      glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
 140      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
 141 @@ -483,7 +483,7 @@ GetMinmax(__GLXclientState * cl, GLbyte
 142
 143      compsize = __glGetTexImage_size(target, 1, format, type, 2, 1, 1);
 144      if (compsize < 0)
 145 -        compsize = 0;
 146 +        return BadLength;
 147
 148      glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
 149      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
 150 @@ -554,7 +554,7 @@ GetColorTable(__GLXclientState * cl, GLb
 151       */
 152      compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
 153      if (compsize < 0)
 154 -        compsize = 0;
 155 +        return BadLength;
 156
 157      glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
 158      __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);