Attachment 543675 Details for Bug 824294

[patch] U_0001-xkb-fix-off-by-one-in-_XkbReadGetNamesReply-and-_Xkb.patch

U_0001-xkb-fix-off-by-one-in-_XkbReadGetNamesReply-and-_Xkb.patch (text/plain), 1.68 KB, created by Stefan Dirsch on 2013-06-11 07:40:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Dirsch

Created: 2013-06-11 07:40:05 UTC

Size: 1.68 KB

patch

obsolete

>From a3bdd2b090915fe0163b062f0e6576fe05dd332e Mon Sep 17 00:00:00 2001
>From: Julien Cristau <jcristau@debian.org>
>Date: Thu, 23 May 2013 20:39:46 +0200
>Subject: [PATCH] xkb: fix off-by-one in _XkbReadGetNamesReply and
> _XkbReadVirtualModMap
>
>The size of the arrays is max_key_code + 1.  This makes these functions
>consistent with the other checks added for CVE-2013-1997.
>
>Also check the XkbGetNames reply when names->keys was just allocated.
>
>Signed-off-by: Julien Cristau <jcristau@debian.org>
>Tested-by: Colin Walters <walters@verbum.org>
>Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
>---
> src/xkb/XKBGetMap.c | 2 +-
> src/xkb/XKBNames.c  | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c
>index 0875dfd..c73e655 100644
>--- a/src/xkb/XKBGetMap.c
>+++ b/src/xkb/XKBGetMap.c
>@@ -426,7 +426,7 @@ XkbServerMapPtr		srv;
> 
>     if ( rep->totalVModMapKeys>0 ) {
> 	if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
>-	     > xkb->max_key_code)
>+	     > xkb->max_key_code + 1)
> 	    return BadLength;
> 	if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
> 	    (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {
>diff --git a/src/xkb/XKBNames.c b/src/xkb/XKBNames.c
>index 0f1e48e..3a8860b 100644
>--- a/src/xkb/XKBNames.c
>+++ b/src/xkb/XKBNames.c
>@@ -180,7 +180,7 @@ _XkbReadGetNamesReply(	Display *		dpy,
> 	    nKeys= xkb->max_key_code+1;
> 	    names->keys= _XkbTypedCalloc(nKeys,XkbKeyNameRec);
> 	}
>-	else if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code)
>+	if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code + 1)
> 	    goto BAILOUT;
> 	if (names->keys!=NULL) {
> 	    if (!_XkbCopyFromReadBuffer(&buf,
>-- 
>1.8.1.4
>

Actions: View | Diff

Attachments on bug 824294: 543669 | 543670 | 543675