Commit 4ca68b87 authored by Nathan Kidd's avatar Nathan Kidd Committed by Julien Cristau

dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo (CVE-2017-12177)

v2: Protect against integer overflow (Alan Coopersmith)
Reviewed-by: Alan Coopersmith's avatarAlan Coopersmith <>
Reviewed-by: Jeremy Huddleston Sequoia's avatarJeremy Huddleston Sequoia <>
Reviewed-by: Julien Cristau's avatarJulien Cristau <>
Signed-off-by: default avatarNathan Kidd <>
Signed-off-by: Julien Cristau's avatarJulien Cristau <>
parent 859b08d5
......@@ -574,6 +574,9 @@ ProcDbeGetVisualInfo(ClientPtr client)
XdbeScreenVisualInfo *pScrVisInfo;
if (stuff->n > UINT32_MAX / sizeof(CARD32))
return BadLength;
REQUEST_FIXED_SIZE(xDbeGetVisualInfoReq, stuff->n * sizeof(CARD32));
if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
return BadAlloc;
......@@ -924,7 +927,7 @@ SProcDbeSwapBuffers(ClientPtr client)
if (stuff->n > UINT32_MAX / sizeof(DbeSwapInfoRec))
return BadAlloc;
return BadLength;
REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, stuff->n * sizeof(xDbeSwapInfo));
if (stuff->n != 0) {
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment