NXv3 (redistributed) https://openid.arctica-project.org/nx-libs/atom?h=pr%2Frender-cleanup 2015-05-01T11:17:03+00:00 2015-05-01T11:17:03+00:00 Keith Packard keithp@keithp.com 2015-05-01T11:09:24+00:00 urn:sha1:dba779d9f99ab2fc6bf05c78515dbdd82840cadd The length checking code validates PutImage height and byte width by making sure that byte-width >= INT32_MAX / height. If height is zero, this generates a divide by zero exception. Allow zero height requests explicitly, bypassing the INT32_MAX check. Fix for regression introduced by fix for CVE-2014-8092. v2: backports to nx-libs 3.6.x (Mike Gabriel) Signed-off-by: Keith Packard <keithp@keithp.com> 2015-02-14T15:14:31+00:00 Alan Coopersmith alan.coopersmith@oracle.com 2014-01-23T05:11:16+00:00 urn:sha1:c1225fe6451d7a5f3741ce0fff8f54e38e0a14da ProcPutImage() calculates a length field from a width, left pad and depth specified by the client (if the specified format is XYPixmap). The calculations for the total amount of memory the server needs for the pixmap can overflow a 32-bit number, causing out-of-bounds memory writes on 32-bit systems (since the length is stored in a long int variable). v2: backport to nx-libs 3.6.x (Mike DePaulo) Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Conflicts: dix/dispatch.c 2011-10-10T15:43:39+00:00 Reinhard Tartler siretart@tauware.de 2011-10-10T15:43:39+00:00 urn:sha1:f4092abdf94af6a99aff944d6264bc1284e8bdd4 Summary: Imported nx-X11-3.1.0-1.tar.gz Keywords: Imported nx-X11-3.1.0-1.tar.gz into Git repository