File U_render_check_request_size_before_reading_it.p... of Package tigervnc.1021

Overview Repositories Revisions Requests Users Attributes Meta

File U_render_check_request_size_before_reading_it.patch of Package tigervnc.1021

Subject: render: check request size before reading it
References: bnc#907268, CVE-2014-8100
Patch-Mainline: Upstream
Signed-off-by: Michal Srb <msrb@suse.com>

Otherwise we may be reading outside of the client request.

Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
 render/render.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/render/render.c b/render/render.c
index e3031da..200e0c8 100644
--- a/render/render.c
+++ b/render/render.c
@@ -276,11 +276,11 @@ ProcRenderQueryVersion(ClientPtr client)
 
     REQUEST(xRenderQueryVersionReq);
 
+    REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
+
     pRenderClient->major_version = stuff->majorVersion;
     pRenderClient->minor_version = stuff->minorVersion;
 
-    REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
-
     if ((stuff->majorVersion * 1000 + stuff->minorVersion) <
         (SERVER_RENDER_MAJOR_VERSION * 1000 + SERVER_RENDER_MINOR_VERSION)) {
         rep.majorVersion = stuff->majorVersion;
-- 
1.7.9.2

Places

File U_render_check_request_size_before_reading_it.patch of Package tigervnc.1021

Places