diff options
Diffstat (limited to 'contrib/packages/rpm/sle11/SOURCES/CVE-2010-2240-tree_depth_limit.patch')
-rw-r--r-- | contrib/packages/rpm/sle11/SOURCES/CVE-2010-2240-tree_depth_limit.patch | 73 |
1 files changed, 0 insertions, 73 deletions
diff --git a/contrib/packages/rpm/sle11/SOURCES/CVE-2010-2240-tree_depth_limit.patch b/contrib/packages/rpm/sle11/SOURCES/CVE-2010-2240-tree_depth_limit.patch deleted file mode 100644 index 0507401c..00000000 --- a/contrib/packages/rpm/sle11/SOURCES/CVE-2010-2240-tree_depth_limit.patch +++ /dev/null @@ -1,73 +0,0 @@ ---- xorg-server-1.9.0/dix/window.c.orig 2010-08-23 16:07:24.000000000 +0200 -+++ xorg-server-1.9.0/dix/window.c 2010-08-23 16:14:09.000000000 +0200 -@@ -535,6 +535,48 @@ RealChildHead(WindowPtr pWin) - return NullWindow; - } - -+static int -+TreeDepth(WindowPtr pWin) -+{ -+ int depth = 1; -+ int max_depth = 1; -+ WindowPtr pChild; -+ -+ if (!(pChild = pWin)) -+ return 0; -+ while (1) -+ { -+ if (pChild->firstChild) -+ { -+ ++depth; -+ pChild = pChild->firstChild; -+ continue; -+ } else if (depth > max_depth) -+ max_depth = depth; -+ while (!pChild->nextSib && (pChild != pWin)) { -+ --depth; -+ pChild = pChild->parent; -+ } -+ if (pChild == pWin) -+ break; -+ pChild = pChild->nextSib; -+ } -+ return max_depth; -+} -+ -+static int -+WindowDepth(WindowPtr pWin) -+{ -+ int depth = 0; -+ while (pWin) { -+ ++depth; -+ pWin = pWin->parent; -+ } -+ return depth; -+} -+ -+#define MAX_TREE_DEPTH 256 -+ - /***** - * CreateWindow - * Makes a window in response to client request -@@ -555,6 +597,11 @@ CreateWindow(Window wid, WindowPtr pPare - PixmapFormatRec *format; - WindowOptPtr ancwopt; - -+ if (WindowDepth(pParent) >= MAX_TREE_DEPTH - 1) { -+ *error = BadAlloc; -+ return NullWindow; -+ } -+ - if (class == CopyFromParent) - class = pParent->drawable.class; - -@@ -2434,6 +2481,9 @@ ReparentWindow(WindowPtr pWin, WindowPtr - int bw = wBorderWidth (pWin); - ScreenPtr pScreen; - -+ if (WindowDepth(pParent) + TreeDepth(pWin) >= MAX_TREE_DEPTH) -+ return BadAlloc; -+ - pScreen = pWin->drawable.pScreen; - if (TraverseTree(pWin, CompareWIDs, (pointer)&pParent->drawable.id) == WT_STOPWALKING) - return BadMatch; |