fdo-mirrors/xorg-libx11
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/lib/libx11.git synced 2026-04-04 20:10:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Validation of server responses in XGetImage()

Browse source 
Check if enough bytes were received for specified image type and
geometry. Otherwise GetPixel and other functions could trigger an
out of boundary read later on.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
This commit is contained in:
Tobias Stoeckmann 2016-09-25 21:25:25 +02:00 • committed by Matthieu Herrb
parent 8c29f1607a
commit 8ea762f94f
1 changed files with 20 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
src/GetImage.c
View file

@ -59,6 +59,7 @@ XImage *XGetImage (
char *data;
unsigned long nbytes;
XImage *image;
int planes;
LockDisplay(dpy);
GetReq (GetImage, req);
/*
@ -91,18 +92,28 @@ XImage *XGetImage (
return (XImage *) NULL;
}
_XReadPad (dpy, data, nbytes);
if (format == XYPixmap)
image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
Ones (plane_mask &
(((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
format, 0, data, width, height, dpy->bitmap_pad, 0);
else /* format == ZPixmap */
image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
rep.depth, ZPixmap, 0, data, width, height,
_XGetScanlinePad(dpy, (int) rep.depth), 0);
if (format == XYPixmap) {
image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
Ones (plane_mask &
(((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
format, 0, data, width, height, dpy->bitmap_pad, 0);
planes = image->depth;
} else { /* format == ZPixmap */
image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
rep.depth, ZPixmap, 0, data, width, height,
_XGetScanlinePad(dpy, (int) rep.depth), 0);
planes = 1;
}
if (!image)
Xfree(data);
if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 ||
INT_MAX / image->height <= image->bytes_per_line ||
INT_MAX / planes <= image->height * image->bytes_per_line ||
nbytes < planes * image->height * image->bytes_per_line) {
XDestroyImage(image);
image = NULL;
}
UnlockDisplay(dpy);
SyncHandle();
return (image);