diff options
| author | Koop Mast <kwm@FreeBSD.org> | 2014-12-10 21:35:13 +0000 |
|---|---|---|
| committer | Koop Mast <kwm@FreeBSD.org> | 2014-12-10 21:35:13 +0000 |
| commit | 1ef33079b39900dcc3d50c5e019eb2f8901c525b (patch) | |
| tree | 49084ca45edd067095895911788343ae39bf660b /x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 | |
| parent | Document xserver security advisories. (diff) | |
Fix multiple xserver security advisories in the 1.12.4 xserver.
The patches where not ported to 1.7.7 so mark it forbidden. This version
is not default anymore and will be removed in the 1.14 update that currently
being tested.
Obtained from: xserver upstream
MFH: 2014Q4
Security: 27b9b2f0-8081-11e4-b4ca-bcaec565249c
Notes
Notes:
svn path=/head/; revision=374489
Diffstat (limited to 'x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4')
| -rw-r--r-- | x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 b/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 new file mode 100644 index 000000000000..64436ed41424 --- /dev/null +++ b/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 @@ -0,0 +1,34 @@ +From e0e11644622a589129a01e11e5d105dc74a098de Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Wed, 22 Jan 2014 23:44:46 -0800 +Subject: [PATCH 04/40] dix: integer overflow in REQUEST_FIXED_SIZE() + [CVE-2014-8092 4/4] + +Force use of 64-bit integers when evaluating data provided by clients +in 32-bit fields which can overflow when added or multiplied during +checks. + +Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> +Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> +--- + include/dix.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/dix.h b/include/dix.h +index 991a3ce..e0c6ed8 100644 +--- include/dix.h ++++ include/dix.h +@@ -76,7 +76,8 @@ SOFTWARE. + + #define REQUEST_FIXED_SIZE(req, n)\ + if (((sizeof(req) >> 2) > client->req_len) || \ +- (((sizeof(req) + (n) + 3) >> 2) != client->req_len)) \ ++ ((n >> 2) >= client->req_len) || \ ++ ((((uint64_t) sizeof(req) + (n) + 3) >> 2) != (uint64_t) client->req_len)) \ + return(BadLength) + + #define LEGAL_NEW_RESOURCE(id,client)\ +-- +2.1.2 + |