Commit afe17702 authored by Adam Jackson's avatar Adam Jackson 💣 Committed by Alan Coopersmith

glx: Request length checks for SetClientInfoARB [CVE-2014-8098 5/8]

Reviewed-by: Keith Packard's avatarKeith Packard <keithp@keithp.com>
Reviewed-by: Julien Cristau's avatarJulien Cristau <jcristau@debian.org>
Reviewed-by: default avatarMichal Srb <msrb@suse.com>
Reviewed-by: default avatarAndy Ritger <aritger@nvidia.com>
Signed-off-by: Adam Jackson's avatarAdam Jackson <ajax@redhat.com>
Signed-off-by: Alan Coopersmith's avatarAlan Coopersmith <alan.coopersmith@oracle.com>
parent c91e4abc
......@@ -33,18 +33,21 @@ static int
set_client_info(__GLXclientState * cl, xGLXSetClientInfoARBReq * req,
unsigned bytes_per_version)
{
ClientPtr client = cl->client;
char *gl_extensions;
char *glx_extensions;
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
/* Verify that the size of the packet matches the size inferred from the
* sizes specified for the various fields.
*/
const unsigned expected_size = sz_xGLXSetClientInfoARBReq
+ (req->numVersions * bytes_per_version)
+ __GLX_PAD(req->numGLExtensionBytes)
+ __GLX_PAD(req->numGLXExtensionBytes);
int size = sz_xGLXSetClientInfoARBReq;
size = safe_add(size, safe_mul(req->numVersions, bytes_per_version));
size = safe_add(size, safe_pad(req->numGLExtensionBytes));
size = safe_add(size, safe_pad(req->numGLXExtensionBytes));
if (req->length != (expected_size / 4))
if (size < 0 || req->length != (size / 4))
return BadLength;
/* Verify that the actual length of the GL extension string matches what's
......@@ -80,8 +83,11 @@ __glXDisp_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
int
__glXDispSwap_SetClientInfoARB(__GLXclientState * cl, GLbyte * pc)
{
ClientPtr client = cl->client;
xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
req->length = bswap_16(req->length);
req->numVersions = bswap_32(req->numVersions);
req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
......@@ -99,8 +105,11 @@ __glXDisp_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
int
__glXDispSwap_SetClientInfo2ARB(__GLXclientState * cl, GLbyte * pc)
{
ClientPtr client = cl->client;
xGLXSetClientInfoARBReq *req = (xGLXSetClientInfoARBReq *) pc;
REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
req->length = bswap_16(req->length);
req->numVersions = bswap_32(req->numVersions);
req->numGLExtensionBytes = bswap_32(req->numGLExtensionBytes);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment