diff options
Diffstat (limited to 'contrib/packages/rpm/el5/SOURCES/CVE-2013-7439.diff')
| -rw-r--r-- | contrib/packages/rpm/el5/SOURCES/CVE-2013-7439.diff | 80 |
1 files changed, 0 insertions, 80 deletions
diff --git a/contrib/packages/rpm/el5/SOURCES/CVE-2013-7439.diff b/contrib/packages/rpm/el5/SOURCES/CVE-2013-7439.diff deleted file mode 100644 index 1037fa51..00000000 --- a/contrib/packages/rpm/el5/SOURCES/CVE-2013-7439.diff +++ /dev/null @@ -1,80 +0,0 @@ -From 39547d600a13713e15429f49768e54c3173c828d Mon Sep 17 00:00:00 2001 -From: Karl Tomlinson <xmail@karlt.net> -Date: Mon, 18 Feb 2013 01:25:34 +0000 -Subject: MakeBigReq: don't move the last word, already handled by Data32 - -MakeBigReq inserts a length field after the first 4 bytes of the request -(after req->length), pushing everything else back by 4 bytes. - -The current memmove moves everything but the first 4 bytes back. -If a request aligns to the end of the buffer pointer when MakeBigReq is -invoked for that request, this runs over the buffer. -Instead, we need to memmove minus the first 4 bytes (which aren't moved), -minus the last 4 bytes (so we still align to the previous tail). - -The 4 bytes that fell out are already handled with Data32, which will -handle the buffermax correctly. - -The case where req->length = 1 was already not functional. - -Reported by Abhishek Arya <inferno@chromium.org>. - -https://bugzilla.mozilla.org/show_bug.cgi?id=803762 - -Reviewed-by: Jeff Muizelaar <jmuizelaar@mozilla.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> - -diff --git a/include/X11/Xlibint.h b/include/X11/Xlibint.h -index 40965c4..06395b3 100644 ---- a/include/X11/Xlibint.h -+++ b/include/X11/Xlibint.h -@@ -486,6 +486,14 @@ extern void *_XGetRequest(Display *dpy, CARD8 type, size_t len); - req = (xReq *) _XGetRequest(dpy, X_/**/name, SIZEOF(xReq)) - #endif - -+/* -+ * MakeBigReq sets the CARD16 "req->length" to 0 and inserts a new CARD32 -+ * length, after req->length, before the data in the request. The new length -+ * includes the "n" extra 32-bit words. -+ * -+ * Do not use MakeBigReq if there is no data already in the request. -+ * req->length must already be >= 2. -+ */ - #ifdef WORD64 - #define MakeBigReq(req,n) \ - { \ -@@ -493,7 +501,7 @@ extern void *_XGetRequest(Display *dpy, CARD8 type, size_t len); - CARD32 _BRlen = req->length - 1; \ - req->length = 0; \ - _BRdat = ((CARD32 *)req)[_BRlen]; \ -- memmove(((char *)req) + 8, ((char *)req) + 4, _BRlen << 2); \ -+ memmove(((char *)req) + 8, ((char *)req) + 4, (_BRlen - 1) << 2); \ - ((CARD32 *)req)[1] = _BRlen + n + 2; \ - Data32(dpy, &_BRdat, 4); \ - } -@@ -504,13 +512,20 @@ extern void *_XGetRequest(Display *dpy, CARD8 type, size_t len); - CARD32 _BRlen = req->length - 1; \ - req->length = 0; \ - _BRdat = ((CARD32 *)req)[_BRlen]; \ -- memmove(((char *)req) + 8, ((char *)req) + 4, _BRlen << 2); \ -+ memmove(((char *)req) + 8, ((char *)req) + 4, (_BRlen - 1) << 2); \ - ((CARD32 *)req)[1] = _BRlen + n + 2; \ - Data32(dpy, &_BRdat, 4); \ - } - #endif - #endif - -+/* -+ * SetReqLen increases the count of 32-bit words in the request by "n", -+ * or by "badlen" if "n" is too large. -+ * -+ * Do not use SetReqLen if "req" does not already have data after the -+ * xReq header. req->length must already be >= 2. -+ */ - #ifndef __clang_analyzer__ - #define SetReqLen(req,n,badlen) \ - if ((req->length + n) > (unsigned)65535) { \ --- -cgit v0.10.2 - |