16823614 problem in X11/SEC-LABELING s11u2_30
authorAlan Coopersmith <Alan.Coopersmith@Oracle.COM>
Mon, 11 Nov 2013 13:33:08 -0800
changeset 1377 fbbb6fba6990
parent 1376 df86b96964b5
child 1378 a5c3425791b0
16823614 problem in X11/SEC-LABELING
open-src/lib/libXtsol/sun-src/Xtsol.c
open-src/lib/libXtsol/sun-src/Xtsolproto.h
open-src/xserver/xorg/sun-src/tsol/tsolextension.c
--- a/open-src/lib/libXtsol/sun-src/Xtsol.c	Fri Dec 06 18:48:20 2013 -0800
+++ b/open-src/lib/libXtsol/sun-src/Xtsol.c	Mon Nov 11 13:33:08 2013 -0800
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004, 2006, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
@@ -35,8 +35,6 @@
 #include <X11/extensions/Xext.h>
 #include <X11/extensions/extutil.h>
 
-#define _XTSOL_SERVER
-
 #include "Xtsolproto.h"
 #include "Xtsol.h"
 
@@ -454,7 +452,7 @@
     m_label_t *sl;
 {
     register xGetClientLabelReq *req;
-    xGenericReply rep;
+    xGetClientLabelReply rep;
     Status status;
 
     TsolCheckExtension(dpy);
@@ -468,11 +466,16 @@
     req->mask = RES_LABEL;
 
     status = _XReply (dpy, (xReply *)&rep, 0, xFalse);
-    if (status)
+    if (status && (rep.length > 0))
     {
-        if ((int)(rep.data00+rep.data01) > 0)
+        if (rep.blabel_bytes == blabel_size())
         {
-            _XRead (dpy, (char *) sl, rep.data00);
+            _XRead (dpy, (char *) sl, rep.blabel_bytes);
+        }
+        else
+        {
+            _XEatDataWords(dpy, rep.length);
+            status = BadLength;
         }
     }
 
@@ -509,8 +512,15 @@
         /* copy the data to user struct */
         propattrp->uid = rep.uid;
         /* read the label info */
-        if (rep.sllength > 0)
+        if (rep.sllength == blabel_size())
+        {
             _XRead (dpy, (char *) (propattrp->sl), rep.sllength);
+        }
+        else if (rep.length > 0)
+        {
+            _XEatDataWords(dpy, rep.length);
+            status = BadLength;
+        }	    
     }
     
     UnlockDisplay(dpy);
@@ -541,14 +551,20 @@
     req->mask = RES_LABEL;
 
     status = _XReply (dpy, (xReply *)&rep, 0, xFalse); 
-    if (status)
+    if (status && (rep.length > 0))
     {
         /* copy the data to user struct */
         /* read the label info */
-        if ((int)(rep.sllength) > 0)
+        if (rep.sllength == blabel_size())
+        {
             _XRead (dpy, (char *) sl, rep.sllength);
+        }
+        else
+        {
+            _XEatDataWords(dpy, rep.length);
+            status = BadLength;
+        }
     }
-    
     UnlockDisplay(dpy);
     SyncHandle();
     return status;
@@ -618,8 +634,15 @@
         resattrp->uid = rep.uid;
         resattrp->ouid = rep.owneruid;
         /* read the label info */
-        if (rep.sllength > 0)
+        if (rep.sllength  == blabel_size())
+        {
             _XRead (dpy, (char *) (resattrp->sl), rep.sllength);
+        }
+        else if (rep.length > 0)
+        {
+            _XEatDataWords(dpy, rep.length);
+            status = BadLength;
+        }
     }
     UnlockDisplay(dpy);
     SyncHandle();
@@ -652,12 +675,17 @@
     req->mask = RES_LABEL;
 
     status = _XReply (dpy, (xReply *)&rep, 0, xFalse); 
-    if (status)
+    if (status && (rep.length > 0))
     {
-        if ((int)(rep.sllength) > 0) 
+        if (rep.sllength == blabel_size())
         {
             _XRead (dpy, (char *) sl, rep.sllength);
         }
+        else
+        {
+            _XEatDataWords(dpy, rep.length);
+            status = BadLength;
+        }
     }
 
     UnlockDisplay(dpy);
--- a/open-src/lib/libXtsol/sun-src/Xtsolproto.h	Fri Dec 06 18:48:20 2013 -0800
+++ b/open-src/lib/libXtsol/sun-src/Xtsolproto.h	Mon Nov 11 13:33:08 2013 -0800
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004, 2006, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
@@ -68,6 +68,7 @@
 
 /* extension reply sizes */
 #define sz_xGetClientAttributesReply  32
+#define sz_xGetClientLabelReply       32
 #define sz_xGetPropAttributesReply    32
 #define sz_xGetResAttributesReply     32
 #define sz_xTSOLInternReply            0
@@ -200,6 +201,19 @@
     BYTE   type;                         /* = X_Reply            */
     BYTE   pad1;                         /* not used             */
     CARD16 sequenceNumber        B16;
+    CARD32 length                B32;    /* = blabel_bytes / 4;  */
+    CARD32 blabel_bytes          B32;    /* = blabel_size()      */
+    CARD32 pad2                  B32;
+    CARD32 pad3                  B32;
+    CARD32 pad4                  B32;
+    CARD32 pad5                  B32;
+    CARD32 pad6                  B32;
+} xGetClientLabelReply;
+
+typedef struct {
+    BYTE   type;                         /* = X_Reply            */
+    BYTE   pad1;                         /* not used             */
+    CARD16 sequenceNumber        B16;
     CARD32 length                B32;    /* = 4;                 */
     CARD32 uid                   B32;
     CARD16 sllength              B16;
--- a/open-src/xserver/xorg/sun-src/tsol/tsolextension.c	Fri Dec 06 18:48:20 2013 -0800
+++ b/open-src/xserver/xorg/sun-src/tsol/tsolextension.c	Mon Nov 11 13:33:08 2013 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
@@ -1021,7 +1021,11 @@
     TsolInfoPtr tsolinfo, res_tsolinfo;
     WindowPtr	pWin;
 
-    xGetClientAttributesReply rep;
+    xGetClientAttributesReply rep = {
+	.type = X_Reply,
+	.sequenceNumber = client->sequence,
+	.length = 0
+    };
 
     REQUEST(xGetClientAttributesReq);
     REQUEST_SIZE_MATCH(xGetClientAttributesReq);
@@ -1041,8 +1045,6 @@
     res_tsolinfo = GetClientTsolInfo(res_client);
 
     /* Transfer the client info to reply rec */
-    rep.type = X_Reply;
-    rep.sequenceNumber = client->sequence;
     rep.trustflag = (res_tsolinfo->forced_trust == 1
 	|| res_tsolinfo->trusted_path) ? (BYTE)1 : (BYTE)0;
     rep.uid = (CARD32) res_tsolinfo->uid;
@@ -1051,7 +1053,6 @@
     rep.auditid = (CARD32) res_tsolinfo->auid;
     rep.sessionid = (CARD32) res_tsolinfo->asid;
     rep.iaddr = (CARD32) res_tsolinfo->iaddr;
-    rep.length = (CARD32) 0;
 
     if (client->swapped)
     {
@@ -1082,7 +1083,12 @@
     TsolInfoPtr tsolinfo, res_tsolinfo;
     WindowPtr	pWin;
 
-    xGenericReply rep;
+    xGetClientLabelReply rep = {
+	.type = X_Reply,
+	.sequenceNumber = client->sequence,
+	.length = 0,
+	.blabel_bytes = 0
+    };
 
     REQUEST(xGetClientLabelReq);
     REQUEST_SIZE_MATCH(xGetClientLabelReq);
@@ -1101,13 +1107,8 @@
     tsolinfo = GetClientTsolInfo(client);
     res_tsolinfo = GetClientTsolInfo(res_client);
 
-    /* Transfer the client info to reply rec */
-    rep.type = X_Reply;
-    rep.sequenceNumber = client->sequence;
-
     /* allocate temp storage for labels */
     sl = malloc(SL_SIZE);
-    rep.data00 = rep.data01 = 0;
     if (sl == NULL)
         return (BadAlloc);
 
@@ -1115,10 +1116,10 @@
     if (stuff->mask & RES_SL)
     {
         memcpy(sl, res_tsolinfo->sl, SL_SIZE);
-        rep.data00 = SL_SIZE;
+        rep.blabel_bytes = SL_SIZE;
     }
 
-    rep.length = (CARD32)(rep.data00)/4;
+    rep.length = (CARD32)(rep.blabel_bytes)/4;
 
     if (rep.length > 0)
     {
@@ -1129,11 +1130,10 @@
     {
         swaps(&rep.sequenceNumber);
         swapl(&rep.length);
-        swapl(&rep.data00);
-        swapl(&rep.data01);
+        swapl(&rep.blabel_bytes);
     }
 
-    WriteToClient(client, sizeof(xGenericReply), (char *)&rep);
+    WriteToClient(client, sizeof(xGetClientLabelReply), &rep);
 
     if (write_to_client == 1)
     {
@@ -1158,7 +1158,13 @@
     TsolResPtr	tsolres;
     TsolInfoPtr  tsolinfo = GetClientTsolInfo(client);
 
-    xGetPropAttributesReply rep;
+    xGetPropAttributesReply rep  = {
+	.type = X_Reply,
+	.sequenceNumber = client->sequence,
+	.length = 0,
+	.sllength = 0,
+	.illength = 0
+    };
 
     REQUEST(xGetPropAttributesReq);
 
@@ -1210,7 +1216,6 @@
 
     /* allocate temp storage for labels */
     sl = malloc(SL_SIZE);
-    rep.sllength = rep.illength = 0;
     if (sl == NULL)
         return (BadAlloc);
 
@@ -1221,8 +1226,6 @@
         rep.sllength = SL_SIZE;
     }
 
-    rep.type = X_Reply;
-    rep.sequenceNumber = client->sequence;
     rep.length = (CARD32) (rep.sllength)/4;
 
     if (rep.length > 0)
@@ -1262,7 +1265,14 @@
     WindowPtr   pWin;
     TsolResPtr  tsolres = NULL;
 
-    xGetResAttributesReply rep;
+    xGetResAttributesReply rep  = {
+	.type = X_Reply,
+	.sequenceNumber = client->sequence,
+	.length = 0,
+	.sllength = 0,
+	.illength = 0,
+	.iillength = 0
+    };
 
     REQUEST(xGetResAttributesReq);
 
@@ -1304,7 +1314,6 @@
 
     /* allocate temp storage for labels */
     sl = malloc(SL_SIZE);
-    rep.sllength = rep.illength = rep.iillength = 0;
     if (sl == NULL)
         return (BadAlloc);
 
@@ -1315,8 +1324,6 @@
         rep.sllength = SL_SIZE;
     }
 
-    rep.type = X_Reply;
-    rep.sequenceNumber = client->sequence;
     rep.length = (CARD32) (rep.sllength)/4;
 
     if (rep.length > 0)