Attachment 40185 Details for Bug 28823 – check that req->numattribs is not too big

[patch] check that req->numattribs is not too big

0006-glx-validate-numAttribs-field-before-using-it.patch (text/plain), 4.59 KB, created by Julien Cristau on 2010-11-10 14:51:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Julien Cristau

Created: 2010-11-10 14:51:11 UTC

Size: 4.59 KB

patch

obsolete

>From bf188aa2c1ec8a2af39758dd75132118f720d913 Mon Sep 17 00:00:00 2001
>From: Julien Cristau <jcristau@debian.org>
>Date: Wed, 10 Nov 2010 22:39:54 +0100
>Subject: [PATCH 6/7] glx: validate numAttribs field before using it
>
>Signed-off-by: Julien Cristau <jcristau@debian.org>
>---
> glx/glxcmds.c     |   15 +++++++++++++++
> glx/glxcmdsswap.c |   10 ++++++++++
> 2 files changed, 25 insertions(+), 0 deletions(-)
>
>diff --git a/glx/glxcmds.c b/glx/glxcmds.c
>index 70c766c..928c884 100644
>--- a/glx/glxcmds.c
>+++ b/glx/glxcmds.c
>@@ -1284,6 +1284,9 @@ int __glXDisp_CreatePixmap(__GLXclientState *cl, GLbyte *pc)
>     __GLXscreen *pGlxScreen;
>     int err;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXCreatePixmapReq);
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXCreatePixmapReq, req->numAttribs << 3);
> 
>     if (!validGlxScreen(cl->client, req->screen, &pGlxScreen, &err))
>@@ -1397,6 +1400,9 @@ int __glXDisp_CreatePbuffer(__GLXclientState *cl, GLbyte *pc)
>     CARD32			*attrs;
>     int				 width, height, i;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXCreatePbufferReq);
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXCreatePbufferReq, req->numAttribs << 3);
> 
>     attrs = (CARD32 *) (req + 1);
>@@ -1484,6 +1490,9 @@ int __glXDisp_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
>     xGLXChangeDrawableAttributesReq *req =
> 	(xGLXChangeDrawableAttributesReq *) pc;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXChangeDrawableAttributesReq);
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
> 
>     return DoChangeDrawableAttributes(cl->client, req->drawable,
>@@ -1496,6 +1505,9 @@ int __glXDisp_ChangeDrawableAttributesSGIX(__GLXclientState *cl, GLbyte *pc)
>     xGLXChangeDrawableAttributesSGIXReq *req =
> 	(xGLXChangeDrawableAttributesSGIXReq *)pc;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXChangeDrawableAttributesSGIXReq);
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesSGIXReq, req->numAttribs << 3);
> 
>     return DoChangeDrawableAttributes(cl->client, req->drawable,
>@@ -1511,6 +1523,9 @@ int __glXDisp_CreateWindow(__GLXclientState *cl, GLbyte *pc)
>     DrawablePtr		 pDraw;
>     int			 err;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXCreateWindowReq);
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXCreateWindowReq, req->numAttribs << 3);
> 
>     LEGAL_NEW_RESOURCE(req->glxwindow, client);
>diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
>index cbd9b88..a5910d6 100644
>--- a/glx/glxcmdsswap.c
>+++ b/glx/glxcmdsswap.c
>@@ -320,6 +320,8 @@ int __glXDispSwap_CreatePixmap(__GLXclientState *cl, GLbyte *pc)
>     __GLX_SWAP_INT(&req->glxpixmap);
>     __GLX_SWAP_INT(&req->numAttribs);
> 
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXCreatePixmapReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
>@@ -401,6 +403,8 @@ int __glXDispSwap_CreatePbuffer(__GLXclientState *cl, GLbyte *pc)
>     __GLX_SWAP_INT(&req->pbuffer);
>     __GLX_SWAP_INT(&req->numAttribs);
> 
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXCreatePbufferReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
>@@ -465,6 +469,8 @@ int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
>     __GLX_SWAP_INT(&req->drawable);
>     __GLX_SWAP_INT(&req->numAttribs);
> 
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
>@@ -487,6 +493,8 @@ int __glXDispSwap_ChangeDrawableAttributesSGIX(__GLXclientState *cl,
>     __GLX_SWAP_INT(&req->drawable);
>     __GLX_SWAP_INT(&req->numAttribs);
> 
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesSGIXReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
>@@ -510,6 +518,8 @@ int __glXDispSwap_CreateWindow(__GLXclientState *cl, GLbyte *pc)
>     __GLX_SWAP_INT(&req->glxwindow);
>     __GLX_SWAP_INT(&req->numAttribs);
> 
>+    if (req->numAttribs > (UINT32_MAX >> 3))
>+	return BadLength;
>     REQUEST_FIXED_SIZE(xGLXCreateWindowReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
>-- 
>1.7.2.3
>

Actions: View | Splinter Review

Attachments on bug 28823: 36729 | 36730 | 36731 | 38061 | 38062 | 38063 | 40181 | 40185

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.