libXcursor: Changes to 'master'
Matthieu Herrb
herrb at kemper.freedesktop.org
Tue Nov 28 14:17:58 UTC 2017
configure.ac | 2 +-
src/file.c | 12 ++++++++++--
2 files changed, 11 insertions(+), 3 deletions(-)
New commits:
commit 4828abe494df8fb4aa00dcaa22a03446ba418d01
Author: Matthieu Herrb <matthieu at herrb.eu>
Date: Sat Nov 25 11:59:31 2017 +0100
libXcursor 1.1.15
Signed-off-by: Matthieu Herrb <matthieu at herrb.eu>
commit 4794b5dd34688158fb51a2943032569d3780c4b8
Author: Tobias Stoeckmann <tobias at stoeckmann.org>
Date: Sat Oct 21 23:47:52 2017 +0200
Fix heap overflows when parsing malicious files. (CVE-2017-16612)
It is possible to trigger heap overflows due to an integer overflow
while parsing images and a signedness issue while parsing comments.
The integer overflow occurs because the chosen limit 0x10000 for
dimensions is too large for 32 bit systems, because each pixel takes
4 bytes. Properly chosen values allow an overflow which in turn will
lead to less allocated memory than needed for subsequent reads.
The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows the
check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to allocate
less memory than needed for subsequent reads.
Signed-off-by: Tobias Stoeckmann <tobias at stoeckmann.org>
Reviewed-by: Matthieu Herrb <matthieu at herrb.eu>
More information about the xorg-commit
mailing list