Tobias Stoeckmann ac15d4cecc render: Fix out of boundary heap access ...

ProcRenderCreateRadialGradient and ProcRenderCreateConicalGradient must
be protected against an integer overflow during length check. This is
already included in ProcRenderCreateLinearGradient since the fix for
CVE-2008-2362.

This can only be successfully exploited on a 32 bit system for an
out of boundary read later on. Validated by using ASAN.

Reviewed-by: Adam Jackson <ajax@redhat.com>

2017-03-13 16:54:20 -04:00

95 KiB

Raw Blame History

View Raw