You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
53 lines
1.9 KiB
53 lines
1.9 KiB
7 years ago
|
From 5d201df72f3d4f4cb8b8f75f980169b03507da38 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Tobias Stoeckmann <tobias@stoeckmann.org>
|
||
|
|
Date: Tue, 28 Nov 2017 21:38:07 +0100
|
||
|
|
Subject: [PATCH] cursor: Fix heap overflows when parsing malicious files.
|
||
|
|
|
||
|
|
It is possible to trigger heap overflows due to an integer overflow
|
||
|
|
while parsing images.
|
||
|
|
|
||
|
|
The integer overflow occurs because the chosen limit 0x10000 for
|
||
|
|
dimensions is too large for 32 bit systems, because each pixel takes
|
||
|
|
4 bytes. Properly chosen values allow an overflow which in turn will
|
||
|
|
lead to less allocated memory than needed for subsequent reads.
|
||
|
|
|
||
|
|
See also: https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8
|
||
|
|
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=103961
|
||
|
|
|
||
|
|
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
|
||
|
|
[Pekka: add link to the corresponding libXcursor commit]
|
||
|
|
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
|
||
|
|
---
|
||
|
|
cursor/xcursor.c | 8 +++++++-
|
||
|
|
1 file changed, 7 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/cursor/xcursor.c b/cursor/xcursor.c
|
||
|
|
index ca41c4a..689c702 100644
|
||
|
|
--- a/cursor/xcursor.c
|
||
|
|
+++ b/cursor/xcursor.c
|
||
|
|
@@ -202,6 +202,11 @@ XcursorImageCreate (int width, int height)
|
||
|
|
{
|
||
|
|
XcursorImage *image;
|
||
|
|
|
||
|
|
+ if (width < 0 || height < 0)
|
||
|
|
+ return NULL;
|
||
|
|
+ if (width > XCURSOR_IMAGE_MAX_SIZE || height > XCURSOR_IMAGE_MAX_SIZE)
|
||
|
|
+ return NULL;
|
||
|
|
+
|
||
|
|
image = malloc (sizeof (XcursorImage) +
|
||
|
|
width * height * sizeof (XcursorPixel));
|
||
|
|
if (!image)
|
||
|
|
@@ -482,7 +487,8 @@ _XcursorReadImage (XcursorFile *file,
|
||
|
|
if (!_XcursorReadUInt (file, &head.delay))
|
||
|
|
return NULL;
|
||
|
|
/* sanity check data */
|
||
|
|
- if (head.width >= 0x10000 || head.height > 0x10000)
|
||
|
|
+ if (head.width > XCURSOR_IMAGE_MAX_SIZE ||
|
||
|
|
+ head.height > XCURSOR_IMAGE_MAX_SIZE)
|
||
|
|
return NULL;
|
||
|
|
if (head.width == 0 || head.height == 0)
|
||
|
|
return NULL;
|
||
|
|
--
|
||
|
|
2.14.3
|
||
|
|
|