mirror of
https://git.yoctoproject.org/poky
synced 2026-04-27 12:32:13 +02:00
fb38c59633
CVE's Fixed: CVE-2023-43785: libX11: out-of-bounds memory access in _XkbReadKeySyms() CVE-2023-43786: libX11: stack exhaustion from infinite recursion in PutSubImage() CVE-2023-43787: libX11: integer overflow in XCreateImage() leading to a heap overflow (From OE-Core rev: 8175d023c203d524d011d8947f90fbd02786c6db) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
64 lines
1.9 KiB
Diff
64 lines
1.9 KiB
Diff
From 7916869d16bdd115ac5be30a67c3749907aea6a0 Mon Sep 17 00:00:00 2001
|
|
From: Yair Mizrahi <yairm@jfrog.com>
|
|
Date: Thu, 7 Sep 2023 16:15:32 -0700
|
|
Subject: [PATCH] CVE-2023-43787: Integer overflow in XCreateImage() leading to
|
|
a heap overflow
|
|
|
|
When the format is `Pixmap` it calculates the size of the image data as:
|
|
ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
|
|
There is no validation on the `width` of the image, and so this
|
|
calculation exceeds the capacity of a 4-byte integer, causing an overflow.
|
|
|
|
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
|
Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/7916869d16bdd115ac5be30a67c3749907aea6a0]
|
|
CVE: CVE-2023-43787
|
|
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
|
|
---
|
|
src/ImUtil.c | 20 +++++++++++++++-----
|
|
1 file changed, 15 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/src/ImUtil.c b/src/ImUtil.c
|
|
index 36f08a0..fbfad33 100644
|
|
--- a/src/ImUtil.c
|
|
+++ b/src/ImUtil.c
|
|
@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
|
|
#include <X11/Xlibint.h>
|
|
#include <X11/Xutil.h>
|
|
#include <stdio.h>
|
|
+#include <limits.h>
|
|
#include "ImUtil.h"
|
|
|
|
static int _XDestroyImage(XImage *);
|
|
@@ -361,13 +362,22 @@ XImage *XCreateImage (
|
|
/*
|
|
* compute per line accelerator.
|
|
*/
|
|
- {
|
|
- if (format == ZPixmap)
|
|
+ if (format == ZPixmap) {
|
|
+ if ((INT_MAX / bits_per_pixel) < width) {
|
|
+ Xfree(image);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
min_bytes_per_line =
|
|
- ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
|
|
- else
|
|
+ ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
|
|
+ } else {
|
|
+ if ((INT_MAX - offset) < width) {
|
|
+ Xfree(image);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
min_bytes_per_line =
|
|
- ROUNDUP((width + offset), image->bitmap_pad);
|
|
+ ROUNDUP((width + offset), image->bitmap_pad);
|
|
}
|
|
if (image_bytes_per_line == 0) {
|
|
image->bytes_per_line = min_bytes_per_line;
|
|
--
|
|
2.35.7
|
|
|