/[gentoo-x86]/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2362.diff
Gentoo

Contents of /x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2362.diff

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1.2 - (show annotations) (download)
Mon Sep 28 07:41:03 2009 UTC (4 years, 10 months ago) by remi
Branch: MAIN
CVS Tags: HEAD
Changes since 1.1: +0 -0 lines
File MIME type: text/plain
FILE REMOVED
x11-base/xorg-server: drop old ebuilds, prune ${FILESDIR}
(Portage version: 2.2_rc42/cvs/Linux i686)

1 diff --git a/render/render.c b/render/render.c
2 index 74c5f63..b53e878 100644
3 --- a/render/render.c
4 +++ b/render/render.c
5 @@ -1920,6 +1920,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
6 LEGAL_NEW_RESOURCE(stuff->pid, client);
7
8 len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
9 + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
10 + return BadLength;
11 if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
12 return BadLength;
13
14 @@ -2493,18 +2495,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
15 return (*ProcRenderVector[stuff->renderReqType]) (client);
16 }
17
18 -static void swapStops(void *stuff, int n)
19 +static void swapStops(void *stuff, int num)
20 {
21 - int i;
22 + int i, n;
23 CARD32 *stops;
24 CARD16 *colors;
25 stops = (CARD32 *)(stuff);
26 - for (i = 0; i < n; ++i) {
27 + for (i = 0; i < num; ++i) {
28 swapl(stops, n);
29 ++stops;
30 }
31 colors = (CARD16 *)(stops);
32 - for (i = 0; i < 4*n; ++i) {
33 + for (i = 0; i < 4*num; ++i) {
34 swaps(stops, n);
35 ++stops;
36 }
37 @@ -2527,6 +2529,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
38 swapl(&stuff->nStops, n);
39
40 len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
41 + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
42 + return BadLength;
43 if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
44 return BadLength;
45
46 @@ -2554,6 +2558,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
47 swapl(&stuff->nStops, n);
48
49 len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
50 + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
51 + return BadLength;
52 if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
53 return BadLength;
54
55 @@ -2578,6 +2584,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
56 swapl(&stuff->nStops, n);
57
58 len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
59 + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
60 + return BadLength;
61 if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
62 return BadLength;
63

  ViewVC Help
Powered by ViewVC 1.1.20