File u_tigervnc-cve-2014-8240.patch of Package tigervnc

Overview Repositories Revisions Requests Users Attributes Meta

File u_tigervnc-cve-2014-8240.patch of Package tigervnc (Revision 5e0845865a31ff0460c2d94ee59dc90f)

Currently displaying revision 5e0845865a31ff0460c2d94ee59dc90f , Show latest

Patch-Mainline: To be upstreamed
References: bnc#900896 CVE-2014-8240
Signed-off-by: Michal Srb <msrb@suse.com>

Index: tigervnc-1.8.0/unix/x0vncserver/Image.cxx
===================================================================
--- tigervnc-1.8.0.orig/unix/x0vncserver/Image.cxx
+++ tigervnc-1.8.0/unix/x0vncserver/Image.cxx
@@ -80,6 +80,14 @@ void Image::Init(int width, int height)
   xim = XCreateImage(dpy, vis, DefaultDepth(dpy, DefaultScreen(dpy)),
                      ZPixmap, 0, 0, width, height, BitmapPad(dpy), 0);
 
+  if (xim->bytes_per_line <= 0 ||
+      xim->height <= 0 ||
+      xim->height >= INT_MAX / xim->bytes_per_line) {
+    vlog.error("Invalid display size");
+    XDestroyImage(xim);
+    exit(1);
+  }
+
   xim->data = (char *)malloc(xim->bytes_per_line * xim->height);
   if (xim->data == NULL) {
     vlog.error("malloc() failed");
@@ -254,6 +262,17 @@ void ShmImage::Init(int width, int heigh
     delete shminfo;
     shminfo = NULL;
     return;
+  }
+
+  if (xim->bytes_per_line <= 0 ||
+      xim->height <= 0 ||
+      xim->height >= INT_MAX / xim->bytes_per_line) {
+    vlog.error("Invalid display size");
+    XDestroyImage(xim);
+    xim = NULL;
+    delete shminfo;
+    shminfo = NULL;
+    return;
   }
 
   shminfo->shmid = shmget(IPC_PRIVATE,

Places

File u_tigervnc-cve-2014-8240.patch of Package tigervnc (Revision 5e0845865a31ff0460c2d94ee59dc90f)

Places