From 6970d8c3c8b96b294159b4029c1428813568e20b Mon Sep 17 00:00:00 2001

From: Dave Airlie <airlied@redhat.com>

Date: Sat, 19 Jan 2008 06:37:58 +1000

Subject: [PATCH] CVE-2007-6429: EVI and MIT-SHM Vunerability updated patch

---

 Xext/EVI.c       |   15 ++++++++++++++-

 Xext/sampleEVI.c |   29 ++++++++++++++++++++++++-----

 Xext/shm.c       |   52 ++++++++++++++++++++++++++++++++++++++++++++--------

 3 files changed, 82 insertions(+), 14 deletions(-)

diff --git a/Xext/EVI.c b/Xext/EVI.c

index 4bd050c..a637bae 100644

--- a/Xext/EVI.c

+++ b/Xext/EVI.c

@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.

 #include <X11/extensions/XEVIstr.h>

 #include "EVIstruct.h"

 #include "modinit.h"

+#include "scrnintstr.h"

 static EviPrivPtr eviPriv;

@@ -84,10 +85,22 @@ ProcEVIGetVisualInfo(ClientPtr client)

 {

     REQUEST(xEVIGetVisualInfoReq);

     xEVIGetVisualInfoReply rep;

-    int n, n_conflict, n_info, sz_info, sz_conflict;

+    int i, n, n_conflict, n_info, sz_info, sz_conflict;

     VisualID32 *conflict;

+    unsigned int total_visuals = 0;

     xExtendedVisualInfo *eviInfo;

     int status;

+

+    /*

+     * do this first, otherwise REQUEST_FIXED_SIZE can overflow.  we assume

+     * here that you don't have more than 2^32 visuals over all your screens;

+     * this seems like a safe assumption.

+     */

+    for (i = 0; i < screenInfo.numScreens; i++)

+	total_visuals += screenInfo.screens[i]->numVisuals;

+    if (stuff->n_visual > total_visuals)

+	return BadValue;

+

     REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);

     status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,

 		&eviInfo, &n_info, &conflict, &n_conflict);

diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c

index 7508aa7..b8f39c7 100644

--- a/Xext/sampleEVI.c

+++ b/Xext/sampleEVI.c

@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.

 #include <X11/extensions/XEVIstr.h>

 #include "EVIstruct.h"

 #include "scrnintstr.h"

+

+#if HAVE_STDINT_H

+#include <stdint.h>

+#elif !defined(INT_MAX)

+#define INT_MAX 0x7fffffff

+#endif

+

 static int sampleGetVisualInfo(

     VisualID32 *visual,

     int n_visual,

@@ -42,24 +49,36 @@ static int sampleGetVisualInfo(

     VisualID32 **conflict_rn,

     int *n_conflict_rn)

 {

-    int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;

+    unsigned int max_sz_evi;

     VisualID32 *temp_conflict;

     xExtendedVisualInfo *evi;

-    int max_visuals = 0, max_sz_conflict, sz_conflict = 0;

+    unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;

     register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;

-    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);

-    if (!*evi_rn)

-         return BadAlloc;

+

+    if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))

+	return BadAlloc;

+    max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;

+    

     for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

         if (screenInfo.screens[scrI]->numVisuals > max_visuals)

             max_visuals = screenInfo.screens[scrI]->numVisuals;

     }

+

+    if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens 

+			       * max_visuals)) 

+	return BadAlloc;

     max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;

+

+    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);

+    if (!*evi_rn)

+         return BadAlloc;

+

     temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);

     if (!temp_conflict) {

         xfree(*evi_rn);

         return BadAlloc;

     }

+

     for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

         for (visualI = 0; visualI < n_visual; visualI++) {

 	    evi[sz_evi].core_visual_id = visual[visualI];

diff --git a/Xext/shm.c b/Xext/shm.c

index e3d7a23..0f7a7eb 100644

--- a/Xext/shm.c

+++ b/Xext/shm.c

@@ -757,6 +757,8 @@ ProcPanoramiXShmCreatePixmap(

     int i, j, result, rc;

     ShmDescPtr shmdesc;

     REQUEST(xShmCreatePixmapReq);

+    unsigned int width, height, depth;

+    unsigned long size;

     PanoramiXRes *newPix;

     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);

@@ -770,11 +772,18 @@ ProcPanoramiXShmCreatePixmap(

 	return rc;

     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);

-    if (!stuff->width || !stuff->height)

+

+    width = stuff->width;

+    height = stuff->height;

+    depth = stuff->depth;

+    if (!width || !height || !depth)

     {

 	client->errorValue = 0;

         return BadValue;

     }

+    if (width > 32767 || height > 32767)

+        return BadAlloc;

+

     if (stuff->depth != 1)

     {

         pDepth = pDraw->pScreen->allowedDepths;

@@ -784,10 +793,19 @@ ProcPanoramiXShmCreatePixmap(

 	client->errorValue = stuff->depth;

         return BadValue;

     }

+

 CreatePmap:

-    VERIFY_SHMSIZE(shmdesc, stuff->offset,

-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,

-		   client);

+    /* now w/h/d are valid; but will they overflow a 32-bit pointer? */

+    size = PixmapBytePad(width, depth) * height;

+    if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) {

+        if (size < width * height)

+            return BadAlloc;

+        /* thankfully, offset is unsigned */

+        if (stuff->offset + size < size)

+            return BadAlloc;

+    }

+

+    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);

     if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))

 	return BadAlloc;

@@ -1086,6 +1104,8 @@ ProcShmCreatePixmap(client)

     register int i, rc;

     ShmDescPtr shmdesc;

     REQUEST(xShmCreatePixmapReq);

+    unsigned int width, height, depth;

+    unsigned long size;

     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);

     client->errorValue = stuff->pid;

@@ -1098,11 +1118,18 @@ ProcShmCreatePixmap(client)

 	return rc;

     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);

-    if (!stuff->width || !stuff->height)

+    

+    width = stuff->width;

+    height = stuff->height;

+    depth = stuff->depth;

+    if (!width || !height || !depth)

     {

 	client->errorValue = 0;

         return BadValue;

     }

+    if (width > 32767 || height > 32767)

+	return BadAlloc;

+

     if (stuff->depth != 1)

     {

         pDepth = pDraw->pScreen->allowedDepths;

@@ -1112,10 +1139,19 @@ ProcShmCreatePixmap(client)

 	client->errorValue = stuff->depth;

         return BadValue;

     }

+

 CreatePmap:

-    VERIFY_SHMSIZE(shmdesc, stuff->offset,

-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,

-		   client);

+    /* now w/h/d are valid; but will they overflow a 32-bit pointer? */

+    size = PixmapBytePad(width, depth) * height;

+    if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) {

+        if (size < width * height)

+            return BadAlloc;

+        /* thankfully, offset is unsigned */

+        if (stuff->offset + size < size)

+            return BadAlloc;

+    }

+

+    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);

     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(

 			    pDraw->pScreen, stuff->width,

 			    stuff->height, stuff->depth,

-- 

1.5.3.6