Re: Yet another Xpm vulnerability
David Dawes <[email protected]>
| Newsgroups | gmane.comp.xfree86.devel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Mar 10, 2005 at 03:25:00PM +0000, Matthias Scheler wrote: > Hello, > >this should probably be fixed in the XFree86 repository before the 4.5.0 >release: > >http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0605 How about the attached patch? What is the mechanism for getting the bad data into the privileged program to start with? Perhaps sanity checks would be advisable elsewhere (like Xlib, if it's coming via a connection to a hacked X server). David
xpm-1.diff
(text/plain, 1.7 KB)
Index: create.c
===================================================================
RCS file: /home/x-cvs/xc/extras/Xpm/lib/create.c,v
retrieving revision 1.8
diff -u -r1.8 create.c
--- create.c 17 Dec 2004 16:38:03 -0000 1.8
+++ create.c 10 Mar 2005 23:35:55 -0000
@@ -995,6 +995,9 @@
if (!*image_return)
return (XpmNoMemory);
+ if ((*image_return)->bitmap_unit < 0 || (*image_return)->bitmap_unit > 32)
+ return (XpmNoMemory);
+
#if !defined(FOR_MSW) && !defined(AMIGA)
if (height != 0 && (*image_return)->bytes_per_line >= INT_MAX / height) {
XDestroyImage(*image_return);
@@ -1215,7 +1218,8 @@
register char *src;
register char *dst;
register unsigned int *iptr;
- register unsigned int x, y, i;
+ register unsigned int x, y;
+ int i;
register char *data;
Pixel pixel, px;
int nbytes, depth, ibu, ibpp;
Index: scan.c
===================================================================
RCS file: /home/x-cvs/xc/extras/Xpm/lib/scan.c,v
retrieving revision 1.6
diff -u -r1.6 scan.c
--- scan.c 17 Dec 2004 16:38:03 -0000 1.6
+++ scan.c 10 Mar 2005 22:51:15 -0000
@@ -279,6 +279,12 @@
*/
if (image) {
+ if (image->depth < 0 || image->depth > 32)
+ return (XpmNoMemory);
+ if (image->bits_per_pixel < 0 || image->bits_per_pixel > 32)
+ return (XpmNoMemory);
+ if (image->bitmap_unit < 0 || image->bitmap_unit > 32)
+ return (XpmNoMemory);
#ifndef FOR_MSW
# ifndef AMIGA
if (((image->bits_per_pixel | image->depth) == 1) &&
@@ -621,7 +627,8 @@
char *dst;
unsigned int *iptr;
char *data;
- unsigned int x, y, i;
+ unsigned int x, y;
+ int i;
int bits, depth, ibu, ibpp, offset;
unsigned long lbt;
Pixel pixel, px;