nx-libs/nx-X11/programs/Xserver/os/rpcauth.c, branch pr/render-misc-patchesNXv3 (redistributed)
https://openid.arctica-project.org/nx-libs/atom?h=pr%2Frender-misc-patches2015-02-14T15:14:31+00:00unchecked malloc may allow unauthed client to crash Xserver [CVE-2014-8091]2015-02-14T15:14:31+00:00Alan Coopersmithalan.coopersmith@oracle.com2014-01-18T02:54:03+00:00urn:sha1:37e7fb1f64b29ef06ec4d69ab0b7afa99c613383
authdes_ezdecode() calls malloc() using a length provided by the
connection handshake sent by a newly connected client in order
to authenticate to the server, so should be treated as untrusted.
It didn't check if malloc() failed before writing to the newly
allocated buffer, so could lead to a server crash if the server
fails to allocate memory (up to UINT16_MAX bytes, since the len
field is a CARD16 in the X protocol).
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Conflicts:
os/rpcauth.c
Imported nx-X11-3.1.0-1.tar.gz2011-10-10T15:43:39+00:00Reinhard Tartlersiretart@tauware.de2011-10-10T15:43:39+00:00urn:sha1:f4092abdf94af6a99aff944d6264bc1284e8bdd4
Summary: Imported nx-X11-3.1.0-1.tar.gz
Keywords:
Imported nx-X11-3.1.0-1.tar.gz
into Git repository