X-Git-Url: https://git.piment-noir.org/?p=deb_xorg-server.git;a=blobdiff_plain;f=debian%2Fpatches%2FCVE-2014-8xxx%2F0025-glx-Length-checking-for-GLXRender-requests-v2-CVE-20.patch;h=f19cfe3cfd83f0aa61e777fe41d4ada575f6b16c;hp=37c7cd02ec13d15f3d423ea400ff96025e13a47a;hb=4db25562fe97995f20b8adc0f2e6959ed82e8635;hpb=7217e0ca50bba73dad94782e67980aeeb24ab693 diff --git a/debian/patches/CVE-2014-8xxx/0025-glx-Length-checking-for-GLXRender-requests-v2-CVE-20.patch b/debian/patches/CVE-2014-8xxx/0025-glx-Length-checking-for-GLXRender-requests-v2-CVE-20.patch index 37c7cd0..f19cfe3 100644 --- a/debian/patches/CVE-2014-8xxx/0025-glx-Length-checking-for-GLXRender-requests-v2-CVE-20.patch +++ b/debian/patches/CVE-2014-8xxx/0025-glx-Length-checking-for-GLXRender-requests-v2-CVE-20.patch @@ -16,11 +16,9 @@ Signed-off-by: Alan Coopersmith glx/glxcmds.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) -Index: xorg-server-1.15.1/glx/glxcmds.c -=================================================================== ---- xorg-server-1.15.1.orig/glx/glxcmds.c 2014-12-04 11:56:07.897284200 -0500 -+++ xorg-server-1.15.1/glx/glxcmds.c 2014-12-04 11:56:07.893284176 -0500 -@@ -2015,7 +2015,7 @@ +--- a/glx/glxcmds.c ++++ b/glx/glxcmds.c +@@ -2015,7 +2015,7 @@ __glXDisp_Render(__GLXclientState * cl, left = (req->length << 2) - sz_xGLXRenderReq; while (left > 0) { __GLXrenderSizeData entry; @@ -29,7 +27,7 @@ Index: xorg-server-1.15.1/glx/glxcmds.c __GLXdispatchRenderProcPtr proc; int err; -@@ -2034,6 +2034,9 @@ +@@ -2034,6 +2034,9 @@ __glXDisp_Render(__GLXclientState * cl, cmdlen = hdr->length; opcode = hdr->opcode; @@ -39,7 +37,7 @@ Index: xorg-server-1.15.1/glx/glxcmds.c /* ** Check for core opcodes and grab entry data. */ -@@ -2047,6 +2050,10 @@ +@@ -2047,6 +2050,10 @@ __glXDisp_Render(__GLXclientState * cl, return __glXError(GLXBadRenderRequest); } @@ -50,7 +48,7 @@ Index: xorg-server-1.15.1/glx/glxcmds.c if (entry.varsize) { /* variable size command */ extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE, -@@ -2054,17 +2061,9 @@ +@@ -2054,17 +2061,9 @@ __glXDisp_Render(__GLXclientState * cl, if (extra < 0) { return BadLength; }