From 2df882eeb3a70256170127a746a9ba26376599a1 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 2 Mar 2013 11:01:04 -0800
Subject: [PATCH] unvalidated index in _XkbReadVirtualModMap() [CVE-2013-1997
 10/15]

If the X server returns modifier map indexes outside the range of the number
of keys it told us to allocate, out of bounds memory writes could occur.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
---
 src/xkb/XKBGetMap.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c
index ea77f2a3..5551298c 100644
--- a/src/xkb/XKBGetMap.c
+++ b/src/xkb/XKBGetMap.c
@@ -425,6 +425,9 @@ xkbVModMapWireDesc *	wire;
 XkbServerMapPtr		srv;
 
     if ( rep->totalVModMapKeys>0 ) {
+	if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
+	     > xkb->max_key_code)
+	    return BadLength;
 	if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
 	    (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {
 	    return BadAlloc;