X-Git-Url: https://git.piment-noir.org/?p=deb_xorg-server.git;a=blobdiff_plain;f=debian%2Fpatches%2FCVE-2014-8xxx%2F0011-dri3-unvalidated-lengths-in-DRI3-extension-swapped-p.patch;fp=debian%2Fpatches%2FCVE-2014-8xxx%2F0011-dri3-unvalidated-lengths-in-DRI3-extension-swapped-p.patch;h=d8f4b658d181fe393705a6a696723a6d5fec8187;hp=0000000000000000000000000000000000000000;hb=7217e0ca50bba73dad94782e67980aeeb24ab693;hpb=a09e091a5c996d46a398abb27b06fe504591673f

diff --git a/debian/patches/CVE-2014-8xxx/0011-dri3-unvalidated-lengths-in-DRI3-extension-swapped-p.patch b/debian/patches/CVE-2014-8xxx/0011-dri3-unvalidated-lengths-in-DRI3-extension-swapped-p.patch
new file mode 100644
index 0000000..d8f4b65
--- /dev/null
+++ b/debian/patches/CVE-2014-8xxx/0011-dri3-unvalidated-lengths-in-DRI3-extension-swapped-p.patch
@@ -0,0 +1,64 @@
+From 45000a2286023e2307fda53e602ab24afd2193be Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 26 Jan 2014 19:28:05 -0800
+Subject: [PATCH 11/33] dri3: unvalidated lengths in DRI3 extension swapped
+ procs [CVE-2014-8103 1/2]
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ dri3/dri3_request.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+Index: xorg-server-1.15.1/dri3/dri3_request.c
+===================================================================
+--- xorg-server-1.15.1.orig/dri3/dri3_request.c	2014-12-04 11:53:23.380277861 -0500
++++ xorg-server-1.15.1/dri3/dri3_request.c	2014-12-04 11:53:23.376277836 -0500
+@@ -311,6 +311,7 @@
+ sproc_dri3_query_version(ClientPtr client)
+ {
+     REQUEST(xDRI3QueryVersionReq);
++    REQUEST_SIZE_MATCH(xDRI3QueryVersionReq);
+ 
+     swaps(&stuff->length);
+     swapl(&stuff->majorVersion);
+@@ -322,6 +323,7 @@
+ sproc_dri3_open(ClientPtr client)
+ {
+     REQUEST(xDRI3OpenReq);
++    REQUEST_SIZE_MATCH(xDRI3OpenReq);
+ 
+     swaps(&stuff->length);
+     swapl(&stuff->drawable);
+@@ -333,6 +335,7 @@
+ sproc_dri3_pixmap_from_buffer(ClientPtr client)
+ {
+     REQUEST(xDRI3PixmapFromBufferReq);
++    REQUEST_SIZE_MATCH(xDRI3PixmapFromBufferReq);
+ 
+     swaps(&stuff->length);
+     swapl(&stuff->pixmap);
+@@ -348,6 +351,7 @@
+ sproc_dri3_buffer_from_pixmap(ClientPtr client)
+ {
+     REQUEST(xDRI3BufferFromPixmapReq);
++    REQUEST_SIZE_MATCH(xDRI3BufferFromPixmapReq);
+ 
+     swaps(&stuff->length);
+     swapl(&stuff->pixmap);
+@@ -358,6 +362,7 @@
+ sproc_dri3_fence_from_fd(ClientPtr client)
+ {
+     REQUEST(xDRI3FenceFromFDReq);
++    REQUEST_SIZE_MATCH(xDRI3FenceFromFDReq);
+ 
+     swaps(&stuff->length);
+     swapl(&stuff->drawable);
+@@ -369,6 +374,7 @@
+ sproc_dri3_fd_from_fence(ClientPtr client)
+ {
+     REQUEST(xDRI3FDFromFenceReq);
++    REQUEST_SIZE_MATCH(xDRI3FDFromFenceReq);
+ 
+     swaps(&stuff->length);
+     swapl(&stuff->drawable);