CVE-2023-43787: Integer overflow in XCreateImage() leading to a heap overflow
When the format is `Pixmap` it calculates the size of the image data as:
ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
There is no validation on the `width` of the image, and so this
calculation exceeds the capacity of a 4-byte integer, causing an overflow.
Signed-off-by:
Alan Coopersmith <alan.coopersmith@oracle.com>
Loading
Please register or sign in to comment