File u_0002-CVE-2014-0209-integer-overflow-of-reallo... of Package libXfont

Overview Repositories Revisions Requests Users Attributes Meta

File u_0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch of Package libXfont (Revision 3a47e1db4e60f420b0c4c0c0444e7182)

Currently displaying revision 3a47e1db4e60f420b0c4c0c0444e7182 , Show latest

From 3319cc1c44e4f5cd1ddcef7ac075c2703df48006 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri, 25 Apr 2014 23:01:48 -0700
Subject: [PATCH:libXfont 02/12] CVE-2014-XXXA: integer overflow of realloc()
 size in lexAlias()

lexAlias() reads from a file in a loop. It does this by starting with a
64 byte buffer.  If that size limit is hit, it does a realloc of the
buffer size << 1, basically doubling the needed length every time the
length limit is hit.

Eventually, this will shift out to 0 (for a length of ~4gig), and that
length will be passed on to realloc().  A length of 0 (with a valid
pointer) causes realloc to free the buffer on most POSIX platforms,
but the caller will still have a pointer to it, leading to use after
free issues.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
---
 src/fontfile/dirfile.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/fontfile/dirfile.c b/src/fontfile/dirfile.c
index cb28333..38ced75 100644
--- a/src/fontfile/dirfile.c
+++ b/src/fontfile/dirfile.c
@@ -42,6 +42,7 @@ in this Software without prior written authorization from The Open Group.
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <errno.h>
+#include <limits.h>
 
 static Bool AddFileNameAliases ( FontDirectoryPtr dir );
 static int ReadFontAlias ( char *directory, Bool isFile,
@@ -376,6 +377,9 @@ lexAlias(FILE *file, char **lexToken)
 	    int         nsize;
 	    char       *nbuf;
 
+	    if (tokenSize >= (INT_MAX >> 2))
+		/* Stop before we overflow */
+		return EALLOC;
 	    nsize = tokenSize ? (tokenSize << 1) : 64;
 	    nbuf = realloc(tokenBuf, nsize);
 	    if (!nbuf)
-- 
1.7.9.2

Places

File u_0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch of Package libXfont (Revision 3a47e1db4e60f420b0c4c0c0444e7182)

Places