debian/patches/CVE-2014-8xxx/0034-CVE-2014-8097-additional.patch

   1 From b20912c3d45cbbde3c443e6c3d9e189092fe65e1 Mon Sep 17 00:00:00 2001
   2 From: Keith Packard <keithp@keithp.com>
   3 Date: Tue, 9 Dec 2014 09:30:57 -0800
   4 Subject: dbe: Call to DDX SwapBuffers requires address of int, not unsigned
   5  int [CVE-2014-8097 pt. 2]
   6
   7 When the local types used to walk the DBE request were changed, this
   8 changed the type of the parameter passed to the DDX SwapBuffers API,
   9 but there wasn't a matching change in the API definition.
  10
  11 At this point, with the API frozen, I just stuck a new variable in
  12 with the correct type. Because we've already bounds-checked nStuff to
  13 be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will
  14 fit in a signed int without overflow.
  15
  16 Signed-off-by: Keith Packard <keithp@keithp.com
  17 Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
  18 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
  19
  20 diff --git a/dbe/dbe.c b/dbe/dbe.c
  21 index df2ad5c..e5d928d 100644
  22 --- a/dbe/dbe.c
  23 +++ b/dbe/dbe.c
  24 @@ -452,6 +452,7 @@ ProcDbeSwapBuffers(ClientPtr client)
  25      int error;
  26      unsigned int i, j;
  27      unsigned int nStuff;
  28 +    int nStuff_i;       /* DDX API requires int for nStuff */
  29
  30      REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
  31      nStuff = stuff->n;          /* use local variable for performance. */
  32 @@ -527,9 +528,10 @@ ProcDbeSwapBuffers(ClientPtr client)
  33       * could deal with cross-screen synchronization.
  34       */
  35
  36 -    while (nStuff > 0) {
  37 +    nStuff_i = nStuff;
  38 +    while (nStuff_i > 0) {
  39          pDbeScreenPriv = DBE_SCREEN_PRIV_FROM_WINDOW(swapInfo[0].pWindow);
  40 -        error = (*pDbeScreenPriv->SwapBuffers) (client, &nStuff, swapInfo);
  41 +        error = (*pDbeScreenPriv->SwapBuffers) (client, &nStuff_i, swapInfo);
  42          if (error != Success) {
  43              free(swapInfo);
  44              return error;
  45 --
  46 cgit v0.10.2
  47