Attachment 543669 Details for Bug 824294

[patch] U_0010-unvalidated-index-in-_XkbReadVirtualModMap-CVE-2013-.patch

U_0010-unvalidated-index-in-_XkbReadVirtualModMap-CVE-2013-.patch (text/plain), 1.13 KB, created by Stefan Dirsch on 2013-06-11 07:10:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Dirsch

Created: 2013-06-11 07:10:19 UTC

Size: 1.13 KB

patch

obsolete

>From 2df882eeb3a70256170127a746a9ba26376599a1 Mon Sep 17 00:00:00 2001
>From: Alan Coopersmith <alan.coopersmith@oracle.com>
>Date: Sat, 2 Mar 2013 11:01:04 -0800
>Subject: [PATCH] unvalidated index in _XkbReadVirtualModMap() [CVE-2013-1997
> 10/15]
>
>If the X server returns modifier map indexes outside the range of the number
>of keys it told us to allocate, out of bounds memory writes could occur.
>
>Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
>Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
>Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
>---
> src/xkb/XKBGetMap.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c
>index ea77f2a..5551298 100644
>--- a/src/xkb/XKBGetMap.c
>+++ b/src/xkb/XKBGetMap.c
>@@ -425,6 +425,9 @@ xkbVModMapWireDesc *	wire;
> XkbServerMapPtr		srv;
> 
>     if ( rep->totalVModMapKeys>0 ) {
>+	if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
>+	     > xkb->max_key_code)
>+	    return BadLength;
> 	if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
> 	    (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {
> 	    return BadAlloc;
>-- 
>1.8.1.4
>

Actions: View | Diff

Attachments on bug 824294: 543669 | 543670 | 543675