mirror of
https://git.yoctoproject.org/poky
synced 2026-09-19 18:49:32 +02:00
377ce42a6a
Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6424 (From OE-Core rev: 059dc5f4ef9bcf49cb6520f5f2ab1e739f4d42de) Signed-off-by: Baogen Shang <baogen.shang@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
32 lines
1.4 KiB
Diff
32 lines
1.4 KiB
Diff
This patch comes from:
|
|
http://lists.x.org/archives/xorg-devel/2013-October/037996.html
|
|
|
|
Upstream-Status: Backport
|
|
|
|
Signed-off-by: Baogen shang <baogen.shang@windriver.com>
|
|
diff -Naur xorg-server-1.14.0-orig/exa/exa_render.c xorg-server-1.14.0/exa/exa_render.c
|
|
--- xorg-server-1.14.0-orig/exa/exa_render.c 2014-02-27 14:32:38.000000000 +0800
|
|
+++ xorg-server-1.14.0/exa/exa_render.c 2014-02-27 15:46:59.000000000 +0800
|
|
@@ -1141,7 +1141,8 @@
|
|
|
|
exaPrepareAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
|
|
for (; ntrap; ntrap--, traps++)
|
|
- (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1, -bounds.y1);
|
|
+ if (xTrapezoidValid(traps))
|
|
+ (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1, -bounds.y1);
|
|
exaFinishAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
|
|
|
|
xRel = bounds.x1 + xSrc - xDst;
|
|
diff -Naur xorg-server-1.14.0-orig/render/picture.h xorg-server-1.14.0/render/picture.h
|
|
--- xorg-server-1.14.0-orig/render/picture.h 2014-02-27 14:32:26.000000000 +0800
|
|
+++ xorg-server-1.14.0/render/picture.h 2014-02-27 15:48:13.000000000 +0800
|
|
@@ -211,7 +211,7 @@
|
|
/* whether 't' is a well defined not obviously empty trapezoid */
|
|
#define xTrapezoidValid(t) ((t)->left.p1.y != (t)->left.p2.y && \
|
|
(t)->right.p1.y != (t)->right.p2.y && \
|
|
- (int) ((t)->bottom - (t)->top) > 0)
|
|
+ ((t)->bottom > (t)->top))
|
|
|
|
/*
|
|
* Standard NTSC luminance conversions:
|