Attachment 29933 Details for Bug 23645 – 0001-render-Fix-crash-in-RenderAddGlyphs-23645.patch

[patch] 0001-render-Fix-crash-in-RenderAddGlyphs-23645.patch

0001-render-Fix-crash-in-RenderAddGlyphs-23645.patch (text/plain), 1.73 KB, created by Peter Hutterer on 2009-09-29 02:10:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Peter Hutterer

Created: 2009-09-29 02:10:13 UTC

Size: 1.73 KB

patch

obsolete

>From 97377dada583b9f1a08a96bf43660dae0fcaaaab Mon Sep 17 00:00:00 2001
>From: Peter Hutterer <peter.hutterer@who-t.net>
>Date: Tue, 29 Sep 2009 14:25:39 +1000
>Subject: [PATCH] render: Fix crash in RenderAddGlyphs (#23645)
>
>This patch fixes two bugs:
>size is calculated as glyph height * padded_width. If the client submits
>garbage, this may get above INT_MAX, resulting in a negative size if size is
>unsigned. The sanity checks don't trigger for negative sizes and the server
>goes and writes into random memory locations.
>
>If the client submits glyphs with a width or height 0, the destination
>pixmap is NULL, causing a null-pointer dereference. Since there's nothing to
>composite if the width/height is 0, we might as well skip the whole thing
>anyway.
>
>Tested with Xvfb, Xephyr and Xorg.
>
>X.Org Bug 23645 <http://bugs.freedesktop.org/show_bug.cgi?id=23645>
>
>Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
>---
> render/render.c |    6 +++++-
> 1 files changed, 5 insertions(+), 1 deletions(-)
>
>diff --git a/render/render.c b/render/render.c
>index a306766..44e9910 100644
>--- a/render/render.c
>+++ b/render/render.c
>@@ -1043,7 +1043,7 @@ ProcRenderAddGlyphs (ClientPtr client)
>     CARD32	    *gids;
>     xGlyphInfo	    *gi;
>     CARD8	    *bits;
>-    int		    size;
>+    unsigned int    size;
>     int		    err;
>     int		    i, screen;
>     PicturePtr	    pSrc = NULL, pDst = NULL;
>@@ -1131,6 +1131,10 @@ ProcRenderAddGlyphs (ClientPtr client)
> 		ScreenPtr   pScreen;
> 		int	    error;
> 
>+                /* Skip work if it's invisibly small anyway */
>+                if (!width || !height)
>+                    break;
>+
> 		pScreen = screenInfo.screens[screen];
> 		pSrcPix = GetScratchPixmapHeader (pScreen,
> 						  width, height,
>-- 
>1.6.3.rc1.2.g0164.dirty
>

Actions: View | Splinter Review

Attachments on bug 23645: 29933

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.