Hi all, I would like to bring to your attention a patch I have just merged into wayland master:
https://cgit.freedesktop.org/wayland/wayland/commit/?id=5d201df72f3d4f4cb8b8f75f980169b03507da38 commit 5d201df72f3d4f4cb8b8f75f980169b03507da38 Author: Tobias Stoeckmann <tob...@stoeckmann.org> Date: Tue Nov 28 21:38:07 2017 +0100 cursor: Fix heap overflows when parsing malicious files. It is possible to trigger heap overflows due to an integer overflow while parsing images. The integer overflow occurs because the chosen limit 0x10000 for dimensions is too large for 32 bit systems, because each pixel takes 4 bytes. Properly chosen values allow an overflow which in turn will lead to less allocated memory than needed for subsequent reads. See also: https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8 Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=103961 Signed-off-by: Tobias Stoeckmann <tob...@stoeckmann.org> [Pekka: add link to the corresponding libXcursor commit] Signed-off-by: Pekka Paalanen <pekka.paala...@collabora.co.uk> This fix is not yet in any release, so would be nice if distributions cherry-picked this into what they ship, the pick should be trivial for any release so far. The issue has existed in libwayland-cursor ever since it was introduced, before wayland 1.0.0 release. Thanks, pq
pgpBiGrbvPlGU.pgp
Description: OpenPGP digital signature
_______________________________________________ wayland-devel mailing list wayland-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/wayland-devel
