From b031e3b60fa1af9e49449f23d4a84395868be3ab Mon Sep 17 00:00:00 2001

From: Alan Coopersmith <[email protected]>

Date: Sat, 13 Apr 2013 10:20:59 -0700

Subject: [PATCH:libXfixes 1/2] Use _XEatDataWords to avoid overflow of

 _XEatData calculations

rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds

Signed-off-by: Alan Coopersmith <[email protected]>

---

 configure.ac    |    7 +++++++

 src/Cursor.c    |    4 ++--

 src/Region.c    |    2 +-

 src/Xfixesint.h |   14 ++++++++++++++

 4 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/configure.ac b/configure.ac

index b942ffa..bb8e976 100644

--- a/configure.ac

+++ b/configure.ac

@@ -57,6 +57,13 @@ AC_SUBST(FIXESEXT_VERSION)

 # Obtain compiler/linker options for depedencies

 PKG_CHECK_MODULES(FIXESEXT, xproto [fixesproto >= $FIXESEXT_VERSION] xextproto x11)

+# Check for _XEatDataWords function that may be patched into older Xlib releases

+SAVE_LIBS="$LIBS"

+LIBS="$FIXESEXT_LIBS"

+AC_CHECK_FUNCS([_XEatDataWords])

+LIBS="$SAVE_LIBS"

+

+

 AC_CONFIG_FILES([Makefile

 		src/Makefile

 		man/Makefile

diff --git a/src/Cursor.c b/src/Cursor.c

index b3dfed1..641b747 100644

--- a/src/Cursor.c

+++ b/src/Cursor.c

@@ -113,7 +113,7 @@ XFixesGetCursorImage (Display *dpy)

     image = (XFixesCursorImage *) Xmalloc (rlength);

     if (!image)

     {

-	_XEatData (dpy, nbytes);

+	_XEatDataWords(dpy, rep.length);

 	UnlockDisplay (dpy);

 	SyncHandle ();

 	return NULL;

@@ -191,7 +191,7 @@ XFixesGetCursorName (Display *dpy, Cursor cursor, Atom *atom)

 	_XReadPad(dpy, name, (long)rep.nbytes);

 	name[rep.nbytes] = '\0';

     } else {

-	_XEatData(dpy, (unsigned long) (rep.nbytes + 3) & ~3);

+	_XEatDataWords(dpy, rep.length);

 	name = (char *) NULL;

     }

     UnlockDisplay(dpy);

diff --git a/src/Region.c b/src/Region.c

index 042f966..cb0cf6e 100644

--- a/src/Region.c

+++ b/src/Region.c

@@ -338,7 +338,7 @@ XFixesFetchRegionAndBounds (Display	    *dpy,

     rects = Xmalloc (nrects * sizeof (XRectangle));

     if (!rects)

     {

-	_XEatData (dpy, nbytes);

+	_XEatDataWords(dpy, rep.length);

 	UnlockDisplay (dpy);

 	SyncHandle ();

 	return NULL;

diff --git a/src/Xfixesint.h b/src/Xfixesint.h

index 8a4d5fd..7bf5bfd 100644

--- a/src/Xfixesint.h

+++ b/src/Xfixesint.h

@@ -60,4 +60,18 @@ XFixesFindDisplay (Display *dpy);

 #define XFixesSimpleCheckExtension(dpy,i) \

   if (!XFixesHasExtension(i)) { return; }

+#ifndef HAVE__XEATDATAWORDS

+#include <X11/Xmd.h>  /* for LONG64 on 64-bit platforms */

+#include <limits.h>

+

+static inline void _XEatDataWords(Display *dpy, unsigned long n)

+{

+# ifndef LONG64

+    if (n >= (ULONG_MAX >> 2))

+        _XIOError(dpy);

+# endif

+    _XEatData (dpy, n << 2);

+}

+#endif

+

 #endif /* _XFIXESINT_H_ */

-- 

1.7.9.2

From c480fe3271873ec7471b0cbd680f4dac18ca8904 Mon Sep 17 00:00:00 2001

From: Alan Coopersmith <[email protected]>

Date: Sat, 13 Apr 2013 10:24:08 -0700

Subject: [PATCH:libXfixes 2/2] integer overflow in XFixesGetCursorImage()

 [CVE-2013-1983]

If the reported cursor dimensions or name length are too large, the

calculations to allocate memory for them may overflow, leaving us

writing beyond the bounds of the allocation.

Reported-by: Ilja Van Sprundel <[email protected]>

Signed-off-by: Alan Coopersmith <[email protected]>

---

 src/Cursor.c |   30 ++++++++++++++++++------------

 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/src/Cursor.c b/src/Cursor.c

index 641b747..33590b7 100644

--- a/src/Cursor.c

+++ b/src/Cursor.c

@@ -47,6 +47,7 @@

 #include <config.h>

 #endif

 #include "Xfixesint.h"

+#include <limits.h>

 void

 XFixesSelectCursorInput (Display	*dpy,

@@ -74,9 +75,9 @@ XFixesGetCursorImage (Display *dpy)

     XFixesExtDisplayInfo		*info = XFixesFindDisplay (dpy);

     xXFixesGetCursorImageAndNameReq	*req;

     xXFixesGetCursorImageAndNameReply	rep;

-    int					npixels;

-    int					nbytes_name;

-    int					nbytes, nread, rlength;

+    size_t				npixels;

+    size_t				nbytes_name;

+    size_t				nbytes, nread, rlength;

     XFixesCursorImage			*image;

     char				*name;

@@ -101,16 +102,21 @@ XFixesGetCursorImage (Display *dpy)

     }

     npixels = rep.width * rep.height;

     nbytes_name = rep.nbytes;

-    /* reply data length */

-    nbytes = (long) rep.length << 2;

-    /* bytes of actual data in the reply */

-    nread = (npixels << 2) + nbytes_name;

-    /* size of data returned to application */

-    rlength = (sizeof (XFixesCursorImage) + 

-	       npixels * sizeof (unsigned long) +

-	       nbytes_name + 1);

+    if ((rep.length < (INT_MAX >> 2)) &&

+	npixels < (((INT_MAX >> 3) - sizeof (XFixesCursorImage) - 1)

+		   - nbytes_name)) {

+	/* reply data length */

+	nbytes = (size_t) rep.length << 2;

+	/* bytes of actual data in the reply */

+	nread = (npixels << 2) + nbytes_name;

+	/* size of data returned to application */

+	rlength = (sizeof (XFixesCursorImage) +

+		   npixels * sizeof (unsigned long) +

+		   nbytes_name + 1);

-    image = (XFixesCursorImage *) Xmalloc (rlength);

+	image = Xmalloc (rlength);

+    } else

+	image = NULL;

     if (!image)

     {

 	_XEatDataWords(dpy, rep.length);