From e480abd0af181242022a85bff2d4d5e73385255e Mon Sep 17 00:00:00 2001

From: Alan Coopersmith <[email protected]>

Date: Wed, 1 May 2013 17:59:31 -0700

Subject: [PATCH:libxcb] integer overflow in read_packet() [CVE-2013-2064]

Ensure that when calculating the size of the incoming response from the

Xserver, we don't overflow the integer used in the calculations when we

multiply the int32_t length by 4 and add it to the default response size.

Signed-off-by: Alan Coopersmith <[email protected]>

---

 src/xcb_in.c |   13 +++++++++----

 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/xcb_in.c b/src/xcb_in.c

index b810783..8a7af92 100644

--- a/src/xcb_in.c

+++ b/src/xcb_in.c

@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete

 static int read_packet(xcb_connection_t *c)

 {

     xcb_generic_reply_t genrep;

-    int length = 32;

-    int eventlength = 0; /* length after first 32 bytes for GenericEvents */

+    uint64_t length = 32;

+    uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */

+    uint64_t bufsize;

     void *buf;

     pending_reply *pend = 0;

     struct event_list *event;

@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)

     if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)

         eventlength = genrep.length * 4;

-    buf = malloc(length + eventlength +

-            (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));

+    bufsize = length + eventlength +

+        (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));

+    if (bufsize < INT32_MAX)

+        buf = malloc((size_t) bufsize);

+    else

+        buf = NULL;

     if(!buf)

     {

         _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);

-- 

1.7.9.2