Alan Coopersmith bc8e20430b dix: integer overflow in GetHosts() [CVE-2014-8092 2/4] ...

GetHosts() iterates over all the hosts it has in memory, and copies
them to a buffer. The buffer length is calculated by iterating over
all the hosts and adding up all of their combined length. There is a
potential integer overflow, if there are lots and lots of hosts (with
a combined length of > ~4 gig). This should be possible by repeatedly
calling ProcChangeHosts() on 64bit machines with enough memory.

This patch caps the list at 1mb, because multi-megabyte hostname
lists for X access control are insane.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>

2014-12-08 18:09:47 -08:00

..

.gitignore

dix and os: gitignore dix.O and os.O

2011-09-23 17:14:47 -07:00

access.c

dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]

2014-12-08 18:09:47 -08:00

auth.c

os: Clean up warnings

2014-01-12 10:14:49 -08:00

backtrace.c

os: use a constant for backtrace array size

2013-11-01 09:39:53 +10:00

busfault.c

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

client.c

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

connection.c

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

io.c

Fix overflow of ConnectionOutput->size and ->count

2014-11-30 11:37:56 -08:00

log.c

os: "Server terminated successfully" is not an error

2014-11-30 11:35:02 -08:00

Makefile.am

Trap SIGBUS to handle truncated shared memory segments

2013-11-11 15:16:07 -08:00

mitauth.c

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

oscolor.c

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

osdep.h

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

osinit.c

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

rpcauth.c

unchecked malloc may allow unauthed client to crash Xserver [CVE-2014-8091]

2014-12-08 18:09:46 -08:00

strcasecmp.c

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

strcasestr.c

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

strlcat.c

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

strlcpy.c

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

strndup.c

os: Ensure <dix-config.h> is included in strndup.c

2013-02-14 09:20:46 -08:00

utils.c

If fork fails in System(), don't fallthrough to exec()

2014-10-23 17:32:14 -07:00

WaitFor.c

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

xdmauth.c

os: Fix -Wshadow errors

2014-01-22 19:56:31 -08:00

xdmcp.c

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

xprintf.c

os/xprintf: add Xvscnprintf and Xscnprintf

2012-05-03 14:59:23 +10:00

xsha1.c

os: Add libnettle as a choice of SHA1 implementation

2012-11-05 13:34:18 -06:00

xstrans.c

Clean up a couple of warnings in os/

2013-10-31 16:58:12 -07:00