diff options
Diffstat (limited to 'import-layers/yocto-poky/meta/recipes-graphics/xorg-lib/libx11/CVE-2016-7942.patch')
-rw-r--r-- | import-layers/yocto-poky/meta/recipes-graphics/xorg-lib/libx11/CVE-2016-7942.patch | 69 |
1 files changed, 0 insertions, 69 deletions
diff --git a/import-layers/yocto-poky/meta/recipes-graphics/xorg-lib/libx11/CVE-2016-7942.patch b/import-layers/yocto-poky/meta/recipes-graphics/xorg-lib/libx11/CVE-2016-7942.patch deleted file mode 100644 index f5b4d69d4..000000000 --- a/import-layers/yocto-poky/meta/recipes-graphics/xorg-lib/libx11/CVE-2016-7942.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 8ea762f94f4c942d898fdeb590a1630c83235c17 Mon Sep 17 00:00:00 2001 -From: Tobias Stoeckmann <tobias@stoeckmann.org> -Date: Sun, 25 Sep 2016 21:25:25 +0200 -Subject: Validation of server responses in XGetImage() - -Check if enough bytes were received for specified image type and -geometry. Otherwise GetPixel and other functions could trigger an -out of boundary read later on. - -CVE: CVE-2016-7942 -Upstream-Status: Backport - -Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> -Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> -Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> - -diff --git a/src/GetImage.c b/src/GetImage.c -index c461abc..ff32d58 100644 ---- a/src/GetImage.c -+++ b/src/GetImage.c -@@ -59,6 +59,7 @@ XImage *XGetImage ( - char *data; - unsigned long nbytes; - XImage *image; -+ int planes; - LockDisplay(dpy); - GetReq (GetImage, req); - /* -@@ -91,18 +92,28 @@ XImage *XGetImage ( - return (XImage *) NULL; - } - _XReadPad (dpy, data, nbytes); -- if (format == XYPixmap) -- image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual), -- Ones (plane_mask & -- (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))), -- format, 0, data, width, height, dpy->bitmap_pad, 0); -- else /* format == ZPixmap */ -- image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual), -- rep.depth, ZPixmap, 0, data, width, height, -- _XGetScanlinePad(dpy, (int) rep.depth), 0); -+ if (format == XYPixmap) { -+ image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual), -+ Ones (plane_mask & -+ (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))), -+ format, 0, data, width, height, dpy->bitmap_pad, 0); -+ planes = image->depth; -+ } else { /* format == ZPixmap */ -+ image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual), -+ rep.depth, ZPixmap, 0, data, width, height, -+ _XGetScanlinePad(dpy, (int) rep.depth), 0); -+ planes = 1; -+ } - - if (!image) - Xfree(data); -+ if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 || -+ INT_MAX / image->height <= image->bytes_per_line || -+ INT_MAX / planes <= image->height * image->bytes_per_line || -+ nbytes < planes * image->height * image->bytes_per_line) { -+ XDestroyImage(image); -+ image = NULL; -+ } - UnlockDisplay(dpy); - SyncHandle(); - return (image); --- -cgit v0.10.2 - |