mirror of
https://git.yoctoproject.org/poky
synced 2026-05-05 07:39:49 +02:00
96973ede70
Upstream-Status: Backport from3c3a4b767b&0235121c6a(From OE-Core rev: 88abe8ec73f822b461670557539a7df0875325cc) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
45 lines
1.6 KiB
Diff
45 lines
1.6 KiB
Diff
From 3c3a4b767b16174d3213055947ea7f4f88e10ec6 Mon Sep 17 00:00:00 2001
|
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
Date: Tue, 20 May 2025 15:18:19 +0200
|
|
Subject: [PATCH] randr: Check for overflow in RRChangeProviderProperty()
|
|
|
|
A client might send a request causing an integer overflow when computing
|
|
the total size to allocate in RRChangeProviderProperty().
|
|
|
|
To avoid the issue, check that total length in bytes won't exceed the
|
|
maximum integer value.
|
|
|
|
CVE-2025-49180
|
|
|
|
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
|
|
reported by Julian Suleder via ERNW Vulnerability Disclosure.
|
|
|
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
|
|
|
|
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/3c3a4b767b16174d3213055947ea7f4f88e10ec6]
|
|
CVE: CVE-2025-49180
|
|
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
|
---
|
|
randr/rrproviderproperty.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
|
|
index 69f66ed278..0c3dcd1bc5 100644
|
|
--- a/randr/rrproviderproperty.c
|
|
+++ b/randr/rrproviderproperty.c
|
|
@@ -182,7 +182,8 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type,
|
|
|
|
if (mode == PropModeReplace || len > 0) {
|
|
void *new_data = NULL, *old_data = NULL;
|
|
-
|
|
+ if (total_len > MAXINT / size_in_bytes)
|
|
+ return BadValue;
|
|
total_size = total_len * size_in_bytes;
|
|
new_value.data = (void *) malloc(total_size);
|
|
if (!new_value.data && total_size) {
|
|
--
|
|
GitLab
|
|
|