linamh/net-misc/nx-X11/files/createpixmap_bounds_check.patch

29 lines
1.2 KiB
Diff
Raw Normal View History

Index: nx-x11-ubuntu/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c
===================================================================
--- nx-x11-ubuntu.orig/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c 2007-06-02 18:49:57.000000000 -0300
+++ nx-x11-ubuntu/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c 2010-03-18 17:51:32.963686193 -0300
@@ -1973,6 +1973,23 @@
client->errorValue = 0;
return BadValue;
}
+ if (stuff->width > 32767 || stuff->height > 32767)
+ {
+ /* It is allowed to try and allocate a pixmap which is larger than
+ * 32767 in either dimension. However, all of the framebuffer code
+ * is buggy and does not reliably draw to such big pixmaps, basically
+ * because the Region data structure operates with signed shorts
+ * for the rectangles in it.
+ *
+ * Furthermore, several places in the X server computes the
+ * size in bytes of the pixmap and tries to store it in an
+ * integer. This integer can overflow and cause the allocated size
+ * to be much smaller.
+ *
+ * So, such big pixmaps are rejected here with a BadAlloc
+ */
+ return BadAlloc;
+ }
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;