diff options
author | Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> | 2018-07-30 15:32:36 +0530 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2018-08-15 10:22:32 +0100 |
commit | bdf13518e79ab949c4320226a399ee4a3913ee30 (patch) | |
tree | a781a29d4e6c7fab95c8a87ae3cefe7ee2776d01 /meta/recipes-graphics/x11-common | |
parent | 4b022a62998e38dbefe1f882bcb9a229485ac9da (diff) | |
download | openembedded-core-bdf13518e79ab949c4320226a399ee4a3913ee30.tar.gz |
libxcursor: CVE-2017-16612
affects: <= 1.1.14
CVE-2017-16612: Fix heap overflows when parsing malicious files
It is possible to trigger heap overflows due to an integer overflow
while parsing images and a signedness issue while parsing comments.
The integer overflow occurs because the chosen limit 0x10000 for
dimensions is too large for 32 bit systems, because each pixel takes 4 bytes.
Properly chosen values allow an overflow which in turn will lead to less
allocated memory than needed for subsequent reads.
The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows the
check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to allocate
less memory than needed for subsequent reads.
Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Diffstat (limited to 'meta/recipes-graphics/x11-common')
0 files changed, 0 insertions, 0 deletions