From b251fdd9d90532871b2a2b2f44a64b0e769fe3fc Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu.herrb@laas.fr>
Date: Tue, 10 Jun 2008 12:22:30 -0600
Subject: [PATCH] CVE-2008-2361 - RENDER Extension crash

An integer overflow may occur in the computation of the size of the
glyph to be allocated by the ProcRenderCreateCursor() function which
will cause less memory to be allocated than expected, leading later to
dereferencing un-mapped memory, causing a crash of the X server.
(cherry picked from commit 5257a0f83d5f3d80d0cd44dd76d047bac3869592)
---
 render/render.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/render/render.c b/render/render.c
index c6d55daa8..40b8439c6 100644
--- a/render/render.c
+++ b/render/render.c
@@ -1562,6 +1562,8 @@ ProcRenderCreateCursor (ClientPtr client)
     pScreen = pSrc->pDrawable->pScreen;
     width = pSrc->pDrawable->width;
     height = pSrc->pDrawable->height;
+    if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+	return BadAlloc;
     if ( stuff->x > width 
       || stuff->y > height )
 	return (BadMatch);