diff -r 800e8c2d47f1 -r d5dacbb8de2b open-src/lib/libxcb/CVE-2013-2064.patch --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/open-src/lib/libxcb/CVE-2013-2064.patch Wed May 15 13:44:02 2013 -0700 @@ -0,0 +1,48 @@ +From e480abd0af181242022a85bff2d4d5e73385255e Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Wed, 1 May 2013 17:59:31 -0700 +Subject: [PATCH:libxcb] integer overflow in read_packet() [CVE-2013-2064] + +Ensure that when calculating the size of the incoming response from the +Xserver, we don't overflow the integer used in the calculations when we +multiply the int32_t length by 4 and add it to the default response size. + +Signed-off-by: Alan Coopersmith +--- + src/xcb_in.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/src/xcb_in.c b/src/xcb_in.c +index b810783..8a7af92 100644 +--- a/src/xcb_in.c ++++ b/src/xcb_in.c +@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete + static int read_packet(xcb_connection_t *c) + { + xcb_generic_reply_t genrep; +- int length = 32; +- int eventlength = 0; /* length after first 32 bytes for GenericEvents */ ++ uint64_t length = 32; ++ uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */ ++ uint64_t bufsize; + void *buf; + pending_reply *pend = 0; + struct event_list *event; +@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c) + if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT) + eventlength = genrep.length * 4; + +- buf = malloc(length + eventlength + +- (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t))); ++ bufsize = length + eventlength + ++ (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)); ++ if (bufsize < INT32_MAX) ++ buf = malloc((size_t) bufsize); ++ else ++ buf = NULL; + if(!buf) + { + _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT); +-- +1.7.9.2 +